Quick answers
- Is CVE-2026-86515 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86515 being exploited in the wild.
- How severe is CVE-2026-86515?
- Medium severity, with a CVSS score of 4.3, published 8 September 2026.
- Which products and versions are affected?
- Vgmstream up to r2117.
- Is there a fix for CVE-2026-86515?
- A patch was published on 2026-09-08: Patch commit 4b6a02dd1aff6428255db912563d77d4cb0a143e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86515 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-86515?
- Check whether you run Vgmstream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the add_entry function of src/meta/txtp_parser.c in vgmstream up to revision r2117. Improper validation of the range_start and range_end arguments allows an attacker to trigger uncontrolled resource consumption. The attack vector is remote—a victim can be exploited by opening a malicious .txtp file. The vulnerability has been publicly disclosed and a patch is available (commit 4b6a02dd1aff6428255db912563d77d4cb0a143e). No authentication or special privileges are required to trigger the issue.
Affected products
- vgmstream vgmstream up to r2117
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patch commit 4b6a02dd1aff6428255db912563d77d4cb0a143e