Medium
vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder
Type: advisorySources: OSV
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-110660
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 08:14 UTC · Revision 1
Source evidence
vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder
core-osv · Original sourcePublished 14 Oct 2026, 15:01 UTC
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.
osv:CVE-2026-110660
Complete source record
{
"id": "a194a95fce712e9c012e771837a54a75d0d402d9f9b6fb1479c3e0feea9bcc5c",
"url": "https://osv.dev/vulnerability/CVE-2026-110660",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder",
"summary": "vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.",
"evidence": "osv:CVE-2026-110660",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-110660",
"aliases": [
"CVE-2026-110660"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/vgmstream/vgmstream",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "71e2361042531fe767fb98300cf8c1ee95e539a0"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "r2117"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"r2117",
"r2083",
"r2055",
"r2023",
"r1980",
"r1951",
"r1917",
"r1896",
"r1879",
"r1866",
"r1843",
"r1831",
"r1810",
"r1800",
"r1776",
"r1721",
"r1702",
"r1690",
"r1667",
"r1640",
"r1626",
"r1625",
"r1050-3448-g77cc431b",
"r1050-3312-g70d20924",
"r1050-3280-gba405509",
"r1050-3264-g86fbfffd",
"r1050-3258-g0b7c3ce6",
"r1050-3086-gc9dc860c",
"r1050-3084-ge114566b",
"r1050-3072-g39f38e0a",
"r1050-3022-g877d791d",
"r1050-2969-g9da8b93f",
"r1050-2955-g9aaba3b3",
"r1050-2946-g1e583645",
"r1050-2908-g14dc8566",
"r1050-2893-g994ef884",
"r1050-2874-gcff06e38",
"r1050-2861-g126e3b41",
"r1050-2838-g987641d8",
"r1050-2819-gcec5b596",
"r1050-2797-g5ea57c08",
"r1050-2792-gbbeb4e4b",
"r1050-2780-geea1c3b4",
"r1050-2771-ge58c73aa",
"r1050-2743-gc479bdb5",
"r1050-2359-ge1184142",
"r1050-2736-g71da1d5e",
"r1050-2696-g0a04a738",
"r1050-2651-g2ac2c0ce",
"r1050-2637-gd871302c",
"r1050-2625-g02efa7d7",
"r1050-2579-gcce259d4",
"r1050-2574-g246222dd",
"r1050-2553-gee3e1700",
"r1050-2552-g2b1de051",
"r1050-2551-g9c8dc69e",
"r1050-2543-g363b8143",
"r1050-2539-gc66fe3ee",
"r1050-2511-g3090c08e",
"r1050-2501-g15362e0b",
"r1050-2466-ga349c26b",
"r1050-2459-ga2fe3aa3",
"r1050-2441-gd64c3872",
"r1050-2410-gead9ec4f",
"r1050-2406-g66626b31",
"r1050-2395-g056ee4fb",
"r1050-2384-g1fb124c2",
"r1050-2366-ged57b41e",
"r1050-2349-g5fe83c0c",
"r1050-2345-g1d28e0f5",
"r1050-2334-g0514807c",
"r1050-2327-ge003e2c2",
"r1050-2320-g7bc5b8b1",
"r1050-2318-g86c104c9",
"r1050-2307-gc0de147a",
"r1050-2304-g50309c19",
"r1050-2297-g3f687f4f",
"1.0.121",
"r1050-2287-g9206295e",
"r1050-2273-g224b4bba",
"r1050-2259-gcb9b9c0d",
"r1050-2257-g95e65ea4",
"r1050-2208-g83b463bf",
"r1050-2178-gd0de0119",
"r1050-2142-gd8ffd7f0",
"r1050-2141-g12ad4237",
"r1050-2085-gae0f1b61",
"r1050-2066-g3dc52c5f",
"r1050-2051-gc9d997f3",
"r1050-2047-gcfb6b8fe",
"r1050-2045-gab807c34",
"r1050-2037-ged397bbc",
"r1050-2028-gac28ccc5",
"r1050-2014-g7a8726dd",
"r1050",
"r1040",
"r1039",
"r1038",
"r1037",
"r1036",
"r1035",
"r1034",
"r1033",
"r1032",
"r1031",
"r1030",
"r1029",
"r1028",
"r1027",
"r1026",
"r1025",
"r1024",
"r1020",
"r1019",
"r1018",
"r1017",
"r1016",
"r1015",
"r1014",
"r1013",
"r1012",
"r1011",
"r1010",
"r1009",
"r1008",
"r1007",
"r1004",
"r1002"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110660.json"
}
}
],
"modified": "2026-10-28T02:30:33.778231545Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110660.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-110660",
"https://www.vulncheck.com/advisories/vgmstream-through-r2117-stack-out-of-bounds-read-via-g-722.1-siren14-decoder",
"https://github.com/vgmstream/vgmstream",
"https://github.com/vgmstream/vgmstream/blob/71e2361042531fe767fb98300cf8c1ee95e539a0/src/coding/libs/g7221_lib.c#L838",
"https://hackmd.io/@haind-pwn/vgmstream-g7221-bitreader-oob-read"
],
"provider_metadata": {
"cwe_ids": [
"CWE-125"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110660.json"
}
},
"related_cves": [
{
"value": "CVE-2026-110660",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 501089,
"published_at": "2026-10-14T15:01:26.072+00:00"
}