CVE-2026-92880

Name of the Vulnerable Software and Affected Versions vgmstream versions prior to r2118

Description A weakness in the EA SCHl parser component allows for remote exploitation. The issue occurs within the vadpcm read coefs be() function located in the src/coding/vadpcm decoder.c file. Manipulation of the entry/entries argument leads to an out-of-bounds write, which is a condition where the program writes data past the end of the intended buffer.

Recommendations Install patch ae37662ad626254ddd96ad69ac263792d7a92024.