{"id":"CVE-2026-110660","summary":"vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder","details":"vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.","modified":"2026-10-16T02:47:32.170008057Z","published":"2026-10-14T15:01:26.072Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110660.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110660.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110660"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vgmstream-through-r2117-stack-out-of-bounds-read-via-g-722.1-siren14-decoder"},{"type":"PACKAGE","url":"https://github.com/vgmstream/vgmstream"},{"type":"ARTICLE","url":"https://github.com/vgmstream/vgmstream/blob/71e2361042531fe767fb98300cf8c1ee95e539a0/src/coding/libs/g7221_lib.c#L838"},{"type":"EVIDENCE","url":"https://hackmd.io/@haind-pwn/vgmstream-g7221-bitreader-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vgmstream/vgmstream","events":[{"introduced":"0"},{"fixed":"71e2361042531fe767fb98300cf8c1ee95e539a0"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"r2117"},{"fixed":"r2117"}]}}],"versions":["r2083","r2055","r2023","r1980","r1951","r1917","r1896","r1879","r1866","r1843","r1831","r1810","r1800","r1776","r1721","r1702","r1690","r1667","r1640","r1626","r1625","r1050-3448-g77cc431b","r1050-3312-g70d20924","r1050-3280-gba405509","r1050-3264-g86fbfffd","r1050-3258-g0b7c3ce6","r1050-3086-gc9dc860c","r1050-3084-ge114566b","r1050-3072-g39f38e0a","r1050-3022-g877d791d","r1050-2969-g9da8b93f","r1050-2955-g9aaba3b3","r1050-2946-g1e583645","r1050-2908-g14dc8566","r1050-2893-g994ef884","r1050-2874-gcff06e38","r1050-2861-g126e3b41","r1050-2838-g987641d8","r1050-2819-gcec5b596","r1050-2797-g5ea57c08","r1050-2792-gbbeb4e4b","r1050-2780-geea1c3b4","r1050-2771-ge58c73aa","r1050-2743-gc479bdb5","r1050-2359-ge1184142","r1050-2736-g71da1d5e","r1050-2696-g0a04a738","r1050-2651-g2ac2c0ce","r1050-2637-gd871302c","r1050-2625-g02efa7d7","r1050-2579-gcce259d4","r1050-2574-g246222dd","r1050-2553-gee3e1700","r1050-2552-g2b1de051","r1050-2551-g9c8dc69e","r1050-2543-g363b8143","r1050-2539-gc66fe3ee","r1050-2511-g3090c08e","r1050-2501-g15362e0b","r1050-2466-ga349c26b","r1050-2459-ga2fe3aa3","r1050-2441-gd64c3872","r1050-2410-gead9ec4f","r1050-2406-g66626b31","r1050-2395-g056ee4fb","r1050-2384-g1fb124c2","r1050-2366-ged57b41e","r1050-2349-g5fe83c0c","r1050-2345-g1d28e0f5","r1050-2334-g0514807c","r1050-2327-ge003e2c2","r1050-2320-g7bc5b8b1","r1050-2318-g86c104c9","r1050-2307-gc0de147a","r1050-2304-g50309c19","r1050-2297-g3f687f4f","1.0.121","r1050-2287-g9206295e","r1050-2273-g224b4bba","r1050-2259-gcb9b9c0d","r1050-2257-g95e65ea4","r1050-2208-g83b463bf","r1050-2178-gd0de0119","r1050-2142-gd8ffd7f0","r1050-2141-g12ad4237","r1050-2085-gae0f1b61","r1050-2066-g3dc52c5f","r1050-2051-gc9d997f3","r1050-2047-gcfb6b8fe","r1050-2045-gab807c34","r1050-2037-ged397bbc","r1050-2028-gac28ccc5","r1050-2014-g7a8726dd","r1050","r1040","r1039","r1038","r1037","r1036","r1035","r1034","r1033","r1032","r1031","r1030","r1029","r1028","r1027","r1026","r1025","r1024","r1020","r1019","r1018","r1017","r1016","r1015","r1014","r1013","r1012","r1011","r1010","r1009","r1008","r1007","r1004","r1002"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110660.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}