{"id":"CVE-2026-104679","title":"VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references","summary":"VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensit…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cvssSource":"cna","cwe":["CWE-611"],"vendor":"Yamaha Corporation","product":"VOCALOID6 Editor","affected":["vocaloid6_editor <= 6.13.2"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:31:40.984Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104679","references":[{"url":"https://www.vocaloid.com/en/news/support_64/"},{"url":"https://www.vocaloid.com/news/support_64/"},{"url":"https://jvn.jp/en/vu/JVNVU93520490/"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T10:20:54.947Z","slug":"CVE-2026-104679","body":"## Overview\n\nVOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.\n\n## Affected\n\n- `vocaloid6_editor <= 6.13.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}