Medium severity · published Sep 8, 2026
CVE-2026-86515
vgmstream txtp txtp_parser.c add_entry resource consumption
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such manipulation of the argument range_start/range_end leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 4b6a02dd1aff6428255db912563d77d4cb0a143e. It is advisable to implement a patch to correct this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VG
vgmstream · Vgmstream
r2117 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86515
github.com
https://github.com/vgmstream/vgmstream/
github.com
https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e
github.com
https://github.com/vgmstream/vgmstream/issues/1973
github.com
https://github.com/vgmstream/vgmstream/pull/1965
vuldb.com
https://vuldb.com/cve/CVE-2026-86515
vuldb.com
https://vuldb.com/submit/908370
More from vgmstream
6.3
CVE-2026-105251
vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds
6.3
CVE-2026-105248
vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write
6.3
CVE-2026-92880
vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write
6.3
CVE-2026-86514
vgmstream txth-txtp txth.c sscanf stack-based overflow
4.8
CVE-2026-105249
vgmstream TXTP File txtp_process.c make_group_random use after free