---
id: CVE-2026-104679
title: >-
  VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML
  external entity references
summary: >-
  VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML
  external entity references. Loading a specially crafted project file may the
  product to initiate unintended communication, potentially leading to the leak
  of sensit…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-611
vendor: Yamaha Corporation
product: VOCALOID6 Editor
affected:
  - vocaloid6_editor <= 6.13.2
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:31:40.984Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104679'
references:
  - url: 'https://www.vocaloid.com/en/news/support_64/'
  - url: 'https://www.vocaloid.com/news/support_64/'
  - url: 'https://jvn.jp/en/vu/JVNVU93520490/'
tags:
  - cve.org
ingestedAt: '2026-10-19T10:20:54.947Z'
---

## Overview

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

## Affected

- `vocaloid6_editor <= 6.13.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.