Heap out-of-bounds read in ValleyBell libvgm DecompressDataBlk
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read in the PCM data-block decompressor, caused by an unbounded compression-table index (CWE-125). A crafted .vgm file with a small type 0x7F table and wider compressed values makes DecompressDataBlk read past heap memory and crash consumers. Exploitation requires user interaction, and the references include an exploit link.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for libvgm.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111150
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-21 CISA SSVC decision points changed
- 2026-10-21 Priority changed: LOW → MEDIUM
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences