{"id":"CVE-2026-86515","summary":"vgmstream txtp txtp_parser.c add_entry resource consumption","details":"A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such manipulation of the argument range_start/range_end leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 4b6a02dd1aff6428255db912563d77d4cb0a143e. It is advisable to implement a patch to correct this issue.","modified":"2026-09-09T08:07:04.468829Z","published":"2026-09-08T03:00:12.750Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86515.json","cna_assigner":"VulDB","cwe_ids":["CWE-400","CWE-404"]},"references":[{"type":"WEB","url":"https://github.com/vgmstream/vgmstream/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86515.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86515"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-86515"},{"type":"ADVISORY","url":"https://vuldb.com/submit/908370"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/399669"},{"type":"REPORT","url":"https://github.com/vgmstream/vgmstream/issues/1973"},{"type":"REPORT","url":"https://vuldb.com/vuln/399669/cti"},{"type":"FIX","url":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e"},{"type":"FIX","url":"https://github.com/vgmstream/vgmstream/pull/1965"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vgmstream/vgmstream","events":[{"introduced":"71e2361042531fe767fb98300cf8c1ee95e539a0"},{"fixed":"4b6a02dd1aff6428255db912563d77d4cb0a143e"}],"database_specific":{"extracted_events":[{"introduced":"r2117"},{"last_affected":"r2117"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["r2117"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86515.json","vanir_signatures_modified":"2026-09-09T08:07:04Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_decoder_close"},"deprecated":false,"digest":{"function_hash":"139559631734300158753687368364948729195","length":256},"id":"CVE-2026-86515-02403a1b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/meta/txtp_parser.c","function":"get_mask"},"deprecated":false,"digest":{"function_hash":"109479269758029153256875655580620587640","length":791},"id":"CVE-2026-86515-059044c9"},{"signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_decoder_open"},"deprecated":false,"digest":{"function_hash":"218306320849684813701766855721342919027","length":479},"id":"CVE-2026-86515-12074461","signature_type":"Function"},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"range_decoder_decode"},"deprecated":false,"digest":{"function_hash":"82872687391934708622064143984111920656","length":841},"id":"CVE-2026-86515-123a4207","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c"},"deprecated":false,"digest":{"line_hashes":["214331603036363686879150766694198220356","237850043238919794957190909887513918009","89553718493655151629220656083527750802","242266759566981918031508587054462373522","213839678410741450377477048009632766411","253433014255968633917119423141758674844","129016508413417096851664351936862430970","98179535299781809124922639380422652225","275832808981291020652508223608299125272","336708927117431318142628241590382384525","24544801646481661537945164432229328105","9316570060969502307572012209825108441","194179110966688474029975194595793922338","54971505997296314025559904122577997612","147153676452731356481543613055269370987","278505570640454947035990041104543993641","316247550851592296256780955812713199739","149819232250686342038043637423583987057","30889780792372435130968231275212773614","147218693061622710532629459065128028227","101985307724260786055986907083573265075","25411933205159105504621409530388486415","138132835316363491602155760786910244939","125762339220467604347213552878912956345","261364025552775035394976394648967839415","92415820280134020170083433996608906905","26646651449450032420218379201068943461","8661318705816985511462074551325427591","181476709887762508826230817405861808096","46291107361918268776029284559979423962","115616346755552882411527156920036163012","180965165990095275133525416592752577856","119909363298956687281649070968837944556","289083511249843929330933620140524770686","312259117271990568673383644495191190355","169201807683473966210438444867248520403","51057537835967236278538940929797553543","233767392279259697544270792370693569164","202208684308798146672465325475464188502","223374529626154734446952337689195670240","133182603138625126302993431717163636849","74693045542063273469540578465841118668","137989698812184652690379460955705614440","252854400539036130245760996390499823133","21867119750784048021209090629676685201","35648805539580237271106392938680950760","33258328062974851698843850957626857510","245016842932573824050637645809367842952","65712980002271214620954670279774636161","302406403042767041772046603467804507240","186155165331943431852211412903370475564","109827957629004324281262884645820641436","318359371486756336999858505561113355125","241930940625404592824561391294740106964","307123406564384200844892359789958515176","95379168323984403092140304204683640450","301407281970933787980902205026464604773","194742946684279403495416826474323776906","231850362194611550667483227510982803605","33469721543505131352213988226597456714","215990229795085374062832214426587578593","259434497429041014971755042417979245789","295864142730101863311206329648426090626","285391235812790962890436788649121317716","261129599683619649607040111462122722596","33362077387523597947074012030626109505","152553654691840628579992221081697844539","132252758753970886394804593962136613376","270225414666796510792916691989180293816","45159406071803383679825951284513036768","332972354839148535390635352741511376793","187062725516008987582145609229461140164","205641338493469013675962622432766044775","301525623946050075368325120771743601742","44047735587904653491850474897970448037","185934908914935047610554936658170819854","93427912347786309139063988391299335276","292539128288448054422021615891600839580","161832797745959843271622802081521384135","216936197184960653866800582043887118641","308988687843748848860452013223320757709","18194954297832407808366363128442284182","339837133916169212221410882216501497406","303527184725785973791284313680127217141","333612812162248863185849086296786261735","246715662631364376224746080932507186193","105150614962236514610396361613678158431","170792376460821589367886595408522565757","67966467043272767982782950944070192597","77812815503561491589639227470604452855","107834596004717330922204911613687859285","37350488608938293720161031192496270758","310658259437901356529721947657734581918","160638114536468687058669518670240882891","80161686766729604898104146475380550901","81847615795012635670055980763598578729","279141565300628071292647485978087603330","156140180459499362956367939824878864743","288289722647625233212815439862865783902","196109544616072148422334389991221384781","229856773849023758422705676521452051453","101496791203602763375279845082247978524","240896898520919198138488077836237965354","96560151838634171721591358630613130156","44582176744669841737926627968200099767","61610498341112610647225193947173911426","141516724724191532363054688757880975543","195135560236126244670188206994200507253","254820874812640477237477246798524928006","270223109508815385235781101550128691110","196494597431235861584633183796604325241","305633989769417510870200843868905105525","169656328256007983873983104672879523373","101125245629459318004050106246776282939","146328363588377094662522751881477139308","200968343515496063678351015305828417177","280683147996129588135546241043451315937","147962804866053058621075484834693458018","9209114484160242327656609981296285855","122175700522206175303836589727012782603","37132713023226217365953752907711741730","133692601418148932524745752579036852399","53070873942082439832547167868797450869","158884205773982926525967976149586196185","136953578220907097036151745334898746891","230734278939189143890100631334780584041","182877667084497249688496597377450525699","53390684346071449642751688881856621252","202528767318703742598044631185893313956","56274752101435596100157948501963053771","228505141322691345778713356693735126231","43933706803665109734992359093369637938","119037311171283548294324203671563912863","381826309782453239526879525788100733","38406602641410349449787946754783523748","85546237622343396834192649964849601816","172227233272494962566319930518848745892","340246452982153377439215776050583544958","246497460747789407087658891749443223997","143071983463669475290659740059369204514","262850150457358186630267288533138416498","255401510137180794608352081936442268867","4327615800576737097922548664506057151","45025692857256838450885907031223487986","46385078522929326036113072661845619204","116193901683320446057005339818642568914","252319061969552785597356450668836550686","264700417815175751624036880942994171467","129458159657634620297279180544362240726","203511918800616285270562861551848762199","285686171651302139224909011938529812442","239843979922509058861608990470244090013","46477499966577017352247891351596322891","313766683838244425025861965136650365544","45823390107482847815965987251040849056"],"threshold":0.9},"id":"CVE-2026-86515-165ef097","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/mio_erisasound.c"},"deprecated":false,"digest":{"line_hashes":["269197622381403366364524668659427915604","100769939109969292714593150370250764560","31165904473998130177727440837045666422","334634913948372968154801749775172163913","165295493993566790992816781078475676916","272117505262722634785266113613096971020","147528557299167568264518806559217400634","64376793514354509734564828676960800007"],"threshold":0.9},"id":"CVE-2026-86515-19a5693c","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_ealayer3.c","function":"ealayer3_parse_frame_v2"},"deprecated":false,"digest":{"length":1558,"function_hash":"291649727382025013415608485996044594465"},"id":"CVE-2026-86515-1e6bd7e2","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_decoder_decode"},"deprecated":false,"digest":{"function_hash":"158990258679748826578556424181729399376","length":1247},"id":"CVE-2026-86515-23e322d1","signature_type":"Function"},{"digest":{"function_hash":"12896741813572753192669158699446849582","length":635},"id":"CVE-2026-86515-2455c01b","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"function":"mpeg_custom_parse_frame_eamp3","file":"src/coding/mpeg_custom_utils_eamp3.c"},"deprecated":false},{"digest":{"function_hash":"273422853025232649410559999997296961485","length":1171},"id":"CVE-2026-86515-3a77ee8a","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_ealayer3.c","function":"ealayer3_parse_frame_v1"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"174056249719679609563313768933286720990","length":2519},"id":"CVE-2026-86515-3c08ae16","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_ealayer3.c","function":"ealayer3_parse_frame_common"}},{"id":"CVE-2026-86515-42740f12","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/nwa_lib.c","function":"nwalib_decode"},"deprecated":false,"digest":{"function_hash":"215461874663467904389195273969855630905","length":699}},{"digest":{"function_hash":"284420639922782138890798022732372567237","length":552},"id":"CVE-2026-86515-4879f9e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_decoder_dequantize"},"deprecated":false},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mp4_aac_decoder.c"},"deprecated":false,"digest":{"line_hashes":["7424779268122598795968505351068582151","330233325428719232042025281591691469925","133550708849577210804854061716915148806","141525424591739284595207708290725697721","147089458639802815263456502686772242693","297401512509784375431515322637447284686","166899902858029329227098086261548658551","233145883001665657096013563962745552187"],"threshold":0.9},"id":"CVE-2026-86515-49ec3496","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"308620171255460731941726201543836130175","length":2986},"id":"CVE-2026-86515-544dd81b","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_decoder_transform"}},{"deprecated":false,"digest":{"function_hash":"137890416397665072622198369230920475361","length":392},"id":"CVE-2026-86515-59644618","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_eamp3.c","function":"eamp3_skip_data"}},{"digest":{"function_hash":"69464234870354940994094201272595670325","length":14093},"id":"CVE-2026-86515-5974b913","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/meta/txth.c","function":"init_vgmstream_txth"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/speex_decoder.c"},"deprecated":false,"digest":{"line_hashes":["238586594269058207802337936518492191748","160628738339553114212520474365221956082","188202660033165324563877101599422542794","311033630059483025020052618110317261392","120815634249497485377887650644991183415","112707378054412767602941802772330629433","265814103854309723425602544627276437548","17337203415251422694823948962609958772","273044645211350846033584871890401335473","122536071528671578148848756407211005237","5728739456709762309720650188427719055","315432011654495300302635354065680463638","192827572692281055754842206805939126991"],"threshold":0.9},"id":"CVE-2026-86515-59cee761"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/nwa_lib.c","function":"nwalib_open"},"deprecated":false,"digest":{"function_hash":"149747177207587516945109476536259161681","length":2685},"id":"CVE-2026-86515-5d2c086a"},{"id":"CVE-2026-86515-617d8249","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_ealayer3.c","function":"ealayer3_skip_data"},"deprecated":false,"digest":{"function_hash":"888839873226847684543913806575750593","length":542}},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"function":"eamp3_write_pcm_block","file":"src/coding/mpeg_custom_utils_eamp3.c"},"deprecated":false,"digest":{"function_hash":"161512457339532842336081194333712997581","length":885},"id":"CVE-2026-86515-62523ce2","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["2237351094625827662831327763223265899","7437411788180650239153536937223772817","309705144596588208776390948381809725651","40485080620774249433343078802643143513"],"threshold":0.9},"id":"CVE-2026-86515-65802e74","signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/hca_decoder.c"},"deprecated":false},{"target":{"file":"src/coding/libs/icelib.c","function":"zlib_init"},"deprecated":false,"digest":{"function_hash":"318915983058117580728816886129714339403","length":427},"id":"CVE-2026-86515-68aeb7d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e"},{"digest":{"function_hash":"24210015437420672789958200086985638481","length":1421},"id":"CVE-2026-86515-72681c62","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/imuse_decoder.c","function":"decode_vima_comp"},"deprecated":false},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"function":"ealayer3_rebuild_mpeg_frame","file":"src/coding/mpeg_custom_utils_ealayer3.c"},"deprecated":false,"digest":{"function_hash":"335000046422814704936722868621417124388","length":3455},"id":"CVE-2026-86515-7e13a994","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/coding/mpeg_custom_utils_ealayer3.c","function":"ealayer3_copy_pcm_block"},"deprecated":false,"digest":{"function_hash":"21147978601259677705652332160248995491","length":867},"id":"CVE-2026-86515-83028df0","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e"},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_ealayer3.c","function":"ealayer3_parse_frame"},"deprecated":false,"digest":{"function_hash":"274525907428645258358238274025478267786","length":553},"id":"CVE-2026-86515-88bae228","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-86515-8b04f1a7","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_codebook_reset"},"deprecated":false,"digest":{"function_hash":"28028993407767312459061000880787199783","length":264}},{"digest":{"line_hashes":["125605596149071314448626042670074368443","93552781048524140119989133235719042852","290143386531328653990193203223167310726","58674068171634033084109605223522990991","209371479007308592622510004755299250862","329647589177119568467844716673792300924","109776196087214969235871893957103167244","142079006148477039082443040065365224331","20610650774046884306437586758341778605","276883707346295416819505727495628388688","202172465719160452427323806803776417961","77250453420349119451203525854485950351","48050472040537072827270445323343422903","337833955906060206672156351048541212866","187787724005637117665167523728474644852","180974954987296102151845677422962325525","82390368015676210170069580083790636581","294255152160644326731286271913330450013","300537042752074926836049530441342549008","177389408091055184008286464390634443632","213254554863306495018553959248778664190","100806762984625019482928099662225690540","44867324503743153800810616820259919403","131687236957183278820641501671672047359","193759564181185229192201463126910945455","167921172517854724119880752148215941467","140930008353835046446785205514383785825","291204488292746729153997914270247899183","90701770656260824134602938014959408723","58090374189065735762341974585378173811","302923197934626607310021710387623739638","74919442172935714728009081666551303446","236214855974124774045928805131449607077","231993038948447102462808595257409732352","159538874963186815889275376395891287162","264760804533377067914528076013418141663","142737115111800794433364966313138658928","118836537048456147972349773371734661331","42503560612147933083272286675628659523","9684782857403278091947065165410787020","104695115340952283409664766365230241177","32463329315788495854284086003477742827","147433525430683976858761733816125114421","320228349381242886437109792082229073606","22131032730081295082188824431256763700","302923197934626607310021710387623739638","101874163834335639761022147561764255211","233007977822294975805760966040371968653","111893133774292255010605258062312743626","59430870905224919002509451526828875056","335585726943554202137714258204542096272","169916175262863102532601722752737197413","302989857766994131519876578006832073924","279394731311730860074798560587110918475","117908840995503366400709020265268088286","141220803171845733577819004000500017382","58270594537250667432078208126411214417","197268623378297457329023478112263385744","38779559817685011491277956223102758220","185049462692018180669281980662611056186","289738600921450906126343260392880906151","296340648614617468302131569362468735090","107863567095639018626479303912385863913","275162662973317928594195681481832157867","113140711291992979858210201150925913580","38131907462517422988731005217767181624","309008200028523514835432247350991614990","144211810566358731916505033324278411683","280187822882014561862504896468606088686","148840733290983035563918333871774274447","301550197178239268330831868529282438259","166940666372307435173888419417966544201","94096933413894140633535152422352354532","65851824323776131252737505342631969854","152487210158309477725325723074756031088","282001679199043161858364357953956959623","167977636790461125682280046939865355109","224776132317321476290007832386067321434","141622832317561685823689054361790025025","333658404155062433714909864773627942691","175600940909505058415971174197096283302","125457118147053255297937324700997064095","169092585775750033096799358531730984942","239775046299584080794743563562244534799","113251565415558918202521372776803832882","220729492164905421570393686176029434070","112346673153926351409804648971187199314","155181145149433663646697728661257489588","282945576522887129750558125341870776669","284682936527538586878657423353044555418","78984854589314878136693580114060197","203765480690661749048393766863723452834","58090374189065735762341974585378173811","302923197934626607310021710387623739638","65618002359489058455864577450731006180","264960328859200761777610436965780228173","84931062746815101836605040033966091080","74214553007888403556470428619266701519","255360489414439423945456681030948755054","253561913789638415784053830461598695243","62750523505301404780920405080997759748","252940338227314848614190685825515980033","36308199535823930359547395829469021626","197696461180520545235730784554836825341","58090374189065735762341974585378173811","302923197934626607310021710387623739638","312460221674189582284219442825228555076"],"threshold":0.9},"id":"CVE-2026-86515-8cb23c5b","signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_eamp3.c"},"deprecated":false},{"id":"CVE-2026-86515-91a2bb72","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_codeinfo_parse"},"deprecated":false,"digest":{"function_hash":"28566635320958323097067185012668169231","length":1287}},{"deprecated":false,"digest":{"function_hash":"69889422602515332083411523119996834662","length":435},"id":"CVE-2026-86515-924c4a32","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/vorbis_custom_utils_sk.c","function":"build_header"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/mio_erisasound.c","function":"MIODecoder_DecodeSoundDCT_Std"},"deprecated":false,"digest":{"function_hash":"301870652503338944411386654550683221784","length":5834},"id":"CVE-2026-86515-9b5af0e4"},{"signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_decoder_block_setup"},"deprecated":false,"digest":{"length":1048,"function_hash":"230397032984698408523657908261863931550"},"id":"CVE-2026-86515-9e3860fa","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"function":"init_hca","file":"src/coding/hca_decoder.c"},"deprecated":false,"digest":{"function_hash":"11780611643184177823761481664396384424","length":1040},"id":"CVE-2026-86515-a878fa31"},{"deprecated":false,"digest":{"function_hash":"113388322942469513081707867062715553571","length":1148},"id":"CVE-2026-86515-ad243df2","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_eamp3.c","function":"mpeg_custom_setup_init_eamp3"}},{"target":{"file":"src/meta/txtp_parser.c"},"deprecated":false,"digest":{"line_hashes":["290526940792817135678485191427675882984","52677055213520356455494298710707035521","50184689649637776034998106828235770442","71448645966859914328246927381365666951","74136016091432306527344398894198673626","334608784844877695946162452919602721907","204139790583118617326651683055006014523","40714425411135108469609696965841777147","227109887960292711573703946634754971988","289145179610307409668390403463041741392","319829529571756011054733592791652593951","260862501352381103440041054832853618959","149641367904849611519277145000865254811","195628360162295186052164735575341414161","32848815488405787753554063830885466278","144189171307497919508118508585891165275","102600164178381832978217011335220439623","250695193499252117004869160898779132770","204750472415113349994257979333063939817","270206241241976942816516614359490556139","327491709728536095202910771668448904794","337380813999581345933715414903398300060","291044736884053381037158556155494327772","170917788264739184340545829496274241647","117708714274826091195090466536218434929","56404085422033392924747632478542319649","331284535817485221770946080022876279188","94160860263875538453776392724063218006","333298614909098923444715245722688433571","268479175634656592896243885195853115834","86135379761678996508661375276322952771","234646678729608998217804387999208141108","126509010437469685105443054682390692507","331166324154989688223820474547858344192","156808843085858839871924975843863025853"],"threshold":0.9},"id":"CVE-2026-86515-ae77c9fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e"},{"deprecated":false,"digest":{"line_hashes":["82619600219153649988459536021450240329","151780218925018506224469161838982868439","285715955662043360260734917905995290237","303078780446471724847476382901203648557","61326644730016947842226699525767416639","31732630040307707053153682434645377403","314968787757159608637417657508810771454","187658881106413039184063685001914639497","80522486161667639601355533710352803443","286965322964105169269872316316616287146","150159293342801587918109154911481979267","73959154039915894088979417674681729839","309616880896087889263069465849421793005","33148893965183000658824563714917345343","54087219875828170506650453826539046969","231060375491758650865672355861914013154","100950958026630468560997631941642018737","32755789946686176762143621440996408058","122788943517023705467380849293991781345","55770786811465153105542125622406506441","53782182229818098288032654752111617992","302923197934626607310021710387623739638","73538906557549218873860691178548591754","338364915367314961897679547132590020820","248830324289726753123947563837082505908","36867975553647373147404014560387470179","40999985753127742003669098084212121342","220897053819624541477872290664514245116","57103695602354873651056810959078065252","212464472623535072115318736554834878077","74849481797280595739227838618314257707","25081591202983728116073977619622425282","114299650219482749273655382400599432521","339633688106426365206754378173255165026","293736033686845930815004240705555119547","49324532815117694447977753242787800621","38980018427726830351267865317260412244","257632959553286064800877978573382411529","296645910900487545437329354805247613569","238484921104011992804001466403245826718","98179468485876291789916941591168847114","321360508026138879503889107826755238166","134350244930581751013429990399645383316","67479072935294807979069523477855603248","102879117642557473703492077142530522688","302923197934626607310021710387623739638","178929718702363474177496825770856127078","336604348005556141407746192478755568165","64566453918314455915347663320757085428","142385405033430912521620963535282445474","7506403097221865495189533510478413382","193722930725269735852583392246350135619","305808036158512151394036652003022770289","154381892816250960288724049921904875726","64659886939977030955580301019423792221","118266806401533135879265450731864723037","335067778977963944632807964501119179862","96240513123959569625798491503764817369","112916674215835625472412349546300706577","58661462247842496599155587891983532558","194661316267501673660821122112221438255","95788717479006002502480412004393290119","58090374189065735762341974585378173811","302923197934626607310021710387623739638","208480508638868387243694233270549311955","235215632001056125175775084192979609967","29164528799788144029670438520879591654","237373923873956416182229604451807032810","255421009885523439331823849456036151438","144450522252057271549134263901150991482","151395754642234628380239034263851295142","47573865773973331928908933677123207035","280938898965573481300367869082913346290","292580503123011439444316325785080818409","264291639301752803928345714503233815634","246373057771978605556066535233838525903","110894133016237266449427612028697087574","255544717450582523548902547862417033641","155809230787061806901821959469024826609","165747971703181275990227998016348612127","273221573540666615704780662759749944069","119301374348551632283281326100755794207","337556944085717132517914141796002571352","269892935955032607236658605436914683292","301938578191833972665739074689905695352","120837971982088865739331946257600681902","259937136569364237502415487251707541699","286036186470312940221216103562286902744","190473222385581993747154733650572695673","66833971672501720692429778665821791051","163675622671307448693795748729738025244","215471962358446482397788702572085404591","25296283374864349801035952948795753937","266568013436576731686935510353770979212","267392275038721940775157609766873310464","302923197934626607310021710387623739638","55462813980728108839199633381358623535","326067538195170740863532905164584508983","208399517411711637201102226773705902859","126104675261550686644184041054504898310","37631367395862394923508231961430447805","37761358260397408707015958162402265890","26908429825105563703468570449003176847","43317046127151745421312841926952920809","205518077861288783475428326694673757127","135260561558471565954868492421046510937","172756835041273219420798857631249356618","107395768387380286515088267700910461354","199914724891330357443906016890188642006","113859722644129812104101266164671312581","318736128273232950521404698895433577238","18895010397300850180211501792464678180","32649360893814284068976966078379723718","127958404577479280290012924943909217135","119165615928051294753963722030060243781","308560117630613174464849986344041309107","83153185106831433484008950837315695887","63380972583830407189777229023589473267","222499384036458946375235338679407097259","97244960676669728825476522394170786032","243661536138093570957241803615719568706","130542488422474692553650393847704164476","331374594875286757728608999842235522644","25811877873142257307176111297820450922","72032561239510587518892835993705851176","311654811734673722362730957228899971088","55287049252317841685245118390561205305","205285607054155881832462906166403099054","115651370865717882048489740086705702963","127829229344140195768300011698928886621","23933539349643025234786285623590090822","181103608460372462204333921797421998528","81075461854790872149156080821276103469","172992107951175280700759473705432795518","69383776625083475877821120979998745548","329281699408716531839387775361378216565","100981045309924623531833717877257960732","14690579208181501932500017379638599146","331374594875286757728608999842235522644","25811877873142257307176111297820450922","72032561239510587518892835993705851176","311654811734673722362730957228899971088","1887015768759825477522152103818612760","162338801296280928348365687442268588118","302783100927061941101281178933653878093","302923197934626607310021710387623739638","130690510646136937783670347995572491357","138142620266614360800549101698864212965","116354279383862751516397038879503312655","58697018864430474364544335742267003887","316100311665514394679032285212113521256","326977429780452321673317834227261948462","66785812555853271586576945890615252834","12785456664891618718927217003496688090","324788538531201391519258297101790636978","445988938466722286037789332922989621","21645652936773359951387855977506259691","257203405490646782728189667506570061877","95603048139241607624990092367162303521","252485418063205295630620114451365513161","319157783416623313813755901499099487626","160382476656237707041327438684640075774","233746793288135734249636505155629368925","281107452854709282156196208138625424767","48695820990387424755850475419632048187","298245870809747209980467687934711537520","229421821756469727663954365005994625284","143289299144684164268576294435343237617","312809972533067646303267524662605703479","288914186134226989295237960922178665643","47254673360148625972153833916172587718","63525900359397585003829586878082537120","229128988292098612200143666543638049037","335823611262665251137655463539098353757","58090374189065735762341974585378173811","302923197934626607310021710387623739638","339834529202946090968947972849683652446","17952324263380594858629806305439672958","72499405974507925989439015645942240724","252388730424385626936854991497762822134","307106416299521692075804896389810777709","31147177159331333453382853740990262423","62499364620709212514854845070127892451","273607417037932500562617067358094536667","7821920080075924330966603921304731995","6973073375716739987213590248639554635","326428037766521430271200463707234801588","64061245284969588155164017183804195637","136202609547807170277617970758854524408","326901839598071079456923968165954942026","314207671478624617230921945839845752041","103631613930786076796349656365524544995","107992815692580129087855863547441455873","58090374189065735762341974585378173811","302923197934626607310021710387623739638","81321358401178950761501403850908315987","73722998698258428407047320787735357548","79871617975227009719846120875944675875","242332368356205028885718243415978418681"],"threshold":0.9},"id":"CVE-2026-86515-b41cab95","signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_ealayer3.c"}},{"deprecated":false,"digest":{"function_hash":"97690707275655714282844413747332987132","length":1614},"id":"CVE-2026-86515-b9692c41","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/meta/txtp_parser.c","function":"add_group"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/mio_erisacontext.c","function":"MIOContext_DecodeERINACodeBytes"},"deprecated":false,"digest":{"function_hash":"130860037300136343018154310625201026407","length":888},"id":"CVE-2026-86515-ba241d4c"},{"deprecated":false,"digest":{"function_hash":"47449075223036291322720265578806544840","length":1613},"id":"CVE-2026-86515-bfb5b0e5","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/meta/ubi_bao.c","function":"open_memory_bao_spk"}},{"id":"CVE-2026-86515-c6e02685","signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/meta/txth.c"},"deprecated":false,"digest":{"line_hashes":["123504500487074886835908868846128954502","325660362459751401148099950955046028552","208869519917449446471960362574825750274","48212977941885801573830981117427469350","179806379974895701003809067160118078436","338738801892077150734776304003794657626","93325004181047036633597056910463192785","312701676792005145947121797377517393607","58860968887797983315282301365168885578","51714630385016749500033830683882877976","34263335963523419733273366886263544509","307306441326021023158187535638085810311","210262056873529558100472267514662996909","78304509106159206352370960888910893719","48905824697267794001106801496118569413","295992110354727450493744078091839686078","191766618910390088239384763589657216030","35151127847683304161819814178804085942","127279848707095058105650098387599246562","244044220381102696078315909757898230117","160296876655360323164211657679595397479","161062896407301932090010916388909517671","310943434244908924986320625461344228705","337418436161074901970380064043995334861","63326114386501416317305841888137048058","11434074054383442481947560002967744907","327074035054086742960250102027789442423","106395990270394174880101032973274776117","62532682986867663093046679128535528853","297044816391235773122540701323811310987","216764730583861330745062856406002843671","90619870422253310111774705875535583477"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/mio_erisacontext.c"},"deprecated":false,"digest":{"line_hashes":["317649225664258274306618257127862300809","9516036261572525890749783749544903172","277165808367973176607166110932028704763","194544954840228617489150327426242032079","140171530748273310521616651708309063605","147012811183404331597300858915238174190"],"threshold":0.9},"id":"CVE-2026-86515-c85a1f1a","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"1477369684463677558943545124071311614","length":1425},"id":"CVE-2026-86515-c9e3575f","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/meta/txtp_parser.c","function":"add_settings"}},{"deprecated":false,"digest":{"function_hash":"300083399562803000700711049504674676385","length":395},"id":"CVE-2026-86515-cb269929","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_codebook_get_qbits"}},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_decoder_reset"},"deprecated":false,"digest":{"function_hash":"39586689346822650194616527457929447070","length":688},"id":"CVE-2026-86515-d06aa8ed","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":2703,"function_hash":"287253014620496264331493885451563173295"},"id":"CVE-2026-86515-d0ab61d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/meta/txth.c","function":"get_bytes_to_samples"}},{"id":"CVE-2026-86515-d3e9cf54","signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mp4_aac_decoder.c","function":"init_mp4_aac"},"deprecated":false,"digest":{"function_hash":"219703678863898009039251917032431688313","length":1878}},{"signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/meta/txtp_parser.c","function":"add_entry"},"deprecated":false,"digest":{"function_hash":"255601505069757618974442145448085324546","length":1195},"id":"CVE-2026-86515-d75f2dcf","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_eamp3.c","function":"eamp3_parse_frame"},"deprecated":false,"digest":{"function_hash":"145839367510578394620607538747626212923","length":1065},"id":"CVE-2026-86515-dbe5fa8a"},{"digest":{"line_hashes":["225197644107162689785916386746573736000","289667425630749775854764682648105143769","216464409282419945508998070235427208218","266983947778749845349893667163576844661","119708519272468022277755829432719739869","168320705105965085592212170504956579555","59789003773379207081361878486459688000","313656677337232643803418689258479891370","295440577095471192316105154519562530672","92105991022063255985332519462774271538","325967630689752680729676967508666069614","86984398277966379781371113453684268720","237847733320269452163277951760848339198","247417161290032534146550607818371229941","112815975696108032663784212928595093459","167982115454838064119181093523742505814","170625830187787717190162977671270975960","119640981010526227137093389171137752129","306567238062639865463591299026844708461","152038743130381248747384908372857505468","1924596163967612540023765763452272702","125818910957575218055649610170782806702","290485198612972683847216963573764117414","290849655875731237003592444456297529498","107435911182207513442817612887317546777","126614016084339408336603095985603874063","302787712357975260389347786170491162550","243786614620461289266633033962069876989","102774601311053464898581946233252085118","265860777968598775880490782489832745544"],"threshold":0.9},"id":"CVE-2026-86515-dc17516e","signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/imuse_decoder.c"},"deprecated":false},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/speex_decoder.c","function":"read_frame"},"deprecated":false,"digest":{"function_hash":"74624915707927793339550960649681591472","length":600},"id":"CVE-2026-86515-dc46a2f5","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["83730626824893933790337213574712224729","316775721999490003656149237303809918827","248581818576156665538885450566538449255","69290303493870244315356296517329531253","198383020848267863480519398591789097497","139489331545836084981772404731220058400","129612859478514095720973453738583147975","182065928596488743068901666530509620461","316967879018532646243219521253361966872","51466499501523178109451789265981088621","286961812397530760505762465681956395505"],"threshold":0.9},"id":"CVE-2026-86515-dc95c2e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/nwa_lib.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/vorbis_custom_utils_sk.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["12897165002779916984163955666398838655","8967700105886283669942823361026379799","272453002762348212130618754311620642356","86094127428295568809408865361965628319","262940289300369958956191831638615252204","38441436802915001416902686228934504191","103801750709793854534493773739506408355","325910371220594432953423351700931665673","73946691493881363174491082446298403171","154371057541383928367047328234732435127","310210021778235882381216317131704314152","164090718858450579921393473364151188395"]},"id":"CVE-2026-86515-e0d852bb"},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/mpeg_custom_utils_ealayer3.c","function":"ealayer3_write_pcm_block"},"deprecated":false,"digest":{"length":2236,"function_hash":"303624820633402831946433955520404882635"},"id":"CVE-2026-86515-e2956faf","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/imuse_decoder.c","function":"decode_data_mcmp"},"deprecated":false,"digest":{"function_hash":"322705883002755758637373042042280636695","length":386},"id":"CVE-2026-86515-ec9c3f78","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e","target":{"file":"src/coding/libs/icelib.c","function":"dct_decoder_ms_stereo"},"deprecated":false,"digest":{"length":374,"function_hash":"245242578294016452650762211450283406193"},"id":"CVE-2026-86515-ede9b30c","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}