CVE-2026-110660

vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221 lib.c, whose bit reader refills without checking the data u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode vector quantized mlt indices() past the stack buffer during format detection, crashing the application.