CVE-2026-105251

A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding/psx_decoder.c of the component VAG File Handler. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. The patch is named 4b8316652a30d40f99ad43310bed273fd1f8a7a3. It is suggested to install a patch to address this issue.

• CWE-119
• CWE-125

• https://github.com/vgmstream/vgmstream/
• https://github.com/vgmstream/vgmstream/commit/4b8316652a30d40f99ad43310bed273fd1f8a7a3
• https://github.com/vgmstream/vgmstream/issues/2000
• https://github.com/vgmstream/vgmstream/pull/2001
• https://vuldb.com/cve/CVE-2026-105251
• https://vuldb.com/submit/976281
• https://vuldb.com/vuln/413458
• https://vuldb.com/vuln/413458/cti

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105246A vulnerability was found in SourceCodester Online Reviewer …7.3
• CVE-2026-105247A vulnerability was determined in SourceCodester Online Revi…7.3
• CVE-2026-105248A security flaw has been discovered in vgmstream up to r2117…6.3
• CVE-2026-105249A weakness has been identified in vgmstream up to r2117. Thi…4.8
• CVE-2026-10525The NEX-Forms WordPress plugin before 9.2.3 does not saniti…6.1
• CVE-2026-105250A security vulnerability has been detected in vgmstream up t…4.3
• CVE-2026-105253A vulnerability was determined in itsourcecode Online Admiss…7.3
• CVE-2026-105254A vulnerability was identified in itsourcecode Online Admiss…6.3
• CVE-2026-10526The EmbedPress WordPress plugin before 4.6.1 does not valid…5.8
• CVE-2026-105263A security flaw has been discovered in Shaarli up to 0.16.3.…4.7
• CVE-2026-10527Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 1…6.3
• CVE-2026-10528A security flaw has been discovered in Orthanc DICOM Server …3.3