Executive brief
vgmstream is a widely-used library for playback of audio formats used in video games. A stack-based buffer overflow vulnerability in the txth metadata parser can allow an attacker to crash the application or potentially execute arbitrary code by providing a malicious audio file. This affects any application using vgmstream to process untrusted game audio files.
Technical details
A stack-based buffer overflow exists in the sscanf function call within src/meta/txth.c of vgmstream up to revision r2117, affecting the txth-txtp component. The vulnerability is caused by improper bounds checking when parsing txth format metadata, allowing an attacker to overflow stack buffers. The attack requires only the ability to provide a malicious txth file to an application using vgmstream; no authentication is required. Exploitation could lead to denial of service or arbitrary code execution. The vulnerability was patched in commit 4669d37a6af94866f6f0628678f9f90d46954e8b, which added proper buffer size constraints to sscanf format specifiers.
Affected products
- vgmstream vgmstream up to r2117
Timeline
- 2026-09-08: disclosed
- 2026-07-11: patched: Patch commit 4669d37a6af94866f6f0628678f9f90d46954e8b