CVE-2026-92879

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024. Applying a patch is advised to resolve this issue.

Published 2026-09-17. Last modified 2026-09-17.