CVE-2026-105249

A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.

• CWE-119
• CWE-416

• https://github.com/vgmstream/vgmstream/
• https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024
• https://github.com/vgmstream/vgmstream/issues/1998
• https://github.com/vgmstream/vgmstream/pull/2008
• https://vuldb.com/cve/CVE-2026-105249
• https://vuldb.com/submit/976279
• https://vuldb.com/vuln/413456
• https://vuldb.com/vuln/413456/cti

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105238A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.…7.3
• CVE-2026-10524The CoCart WordPress plugin before 4.9.0 does not validate a…7.5
• CVE-2026-105245A vulnerability has been found in sgl-project sglang up to 0…3.7
• CVE-2026-105246A vulnerability was found in SourceCodester Online Reviewer …7.3
• CVE-2026-105247A vulnerability was determined in SourceCodester Online Revi…7.3
• CVE-2026-105248A security flaw has been discovered in vgmstream up to r2117…6.3
• CVE-2026-10525The NEX-Forms WordPress plugin before 9.2.3 does not saniti…6.1
• CVE-2026-105250A security vulnerability has been detected in vgmstream up t…4.3
• CVE-2026-10526The EmbedPress WordPress plugin before 4.6.1 does not valid…5.8
• CVE-2026-10527Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 1…6.3
• CVE-2026-10528A security flaw has been discovered in Orthanc DICOM Server …3.3
• CVE-2026-10529A weakness has been identified in westboy CicadasCMS up to 2…2.4