Is CVE-2026-105248 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105248 being exploited in the wild.

How severe is CVE-2026-105248?

Medium severity, with a CVSS score of 6.3, published 5 October 2026.

Is there a fix for CVE-2026-105248?

Yes: fixed in post-r2117 (commit 4669d37a6af94866f6f0628678f9f90d46954e8b). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105248 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105248?

Check whether you run Vgmstream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105248: vgmstream out-of-bounds write in TXTP file handler

CVE-2026-105248 · Severity: medium · CVSS 6.3 · Published 2026-10-05

vgmstream is a library for playing audio streams from video games. A flaw in its TXTP file parser allows an attacker to craft a malicious audio configuration file that could crash the application or potentially execute arbitrary code when processed.

Technologies: Vgmstream. Vendors: Vgmstream.

Quick answers

Is CVE-2026-105248 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105248 being exploited in the wild.
How severe is CVE-2026-105248?: Medium severity, with a CVSS score of 6.3, published 5 October 2026.
Which products and versions are affected?: Vgmstream up to r2117.
Is there a fix for CVE-2026-105248?: Yes: fixed in post-r2117 (commit 4669d37a6af94866f6f0628678f9f90d46954e8b). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105248 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105248?: Check whether you run Vgmstream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: post-r2117 (commit 4669d37a6af94866f6f0628678f9f90d46954e8b)

Technical details

An out-of-bounds write vulnerability exists in the parse_params/txtp_parse function of src/meta/txtp_parser.c. The vulnerability can be triggered by a malicious TXTP file parsed remotely, allowing memory corruption. The patch (commit 4669d37a) adds bounds checking via sscanf format string limits to prevent buffer overflows.

Affected products

vgmstream vgmstream up to r2117

Timeline

2026-10-05: disclosed
2026-07-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.