{"id":"CVE-2026-111150","title":"ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index","summary":"ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-125"],"vendor":"ValleyBell","product":"libvgm","affected":["libvgm <= a6eed945ecf4e5a25cf82004779c6f7e4fd5c319"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T19:17:29.650","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111150","references":[{"url":"https://github.com/ValleyBell/libvgm","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ValleyBell/libvgm/blob/a6eed945ecf4e5a25cf82004779c6f7e4fd5c319/player/dblk_compr.c#L183-L190","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ValleyBell/libvgm/blob/a6eed945ecf4e5a25cf82004779c6f7e4fd5c319/player/dblk_compr.c#L727-L751","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haind-pwn/libvgm-pcm-compression-table-oob-read","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/valleybell-libvgm-through-commit-a6eed945-heap-out-of-bounds-read-via-decompressdatablk","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-15T19:25:46.415Z","slug":"CVE-2026-111150","body":"## Overview\n\nValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}