CVE-2026-86515
- Source
- https://cve.org/CVERecord?id=CVE-2026-86515
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86515.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-86515
- Published
- 2026-09-08T03:00:12Z
- Modified
- 2026-09-30T08:06:55Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- vgmstream txtp txtp_parser.c add_entry resource consumption
- Details
-
A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such manipulation of the argument range_start/range_end leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 4b6a02dd1aff6428255db912563d77d4cb0a143e. It is advisable to implement a patch to correct this issue.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-400", "CWE-404" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86515.json" }- References
-
- https://github.com/vgmstream/vgmstream/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86515.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-86515
- https://vuldb.com/cve/CVE-2026-86515
- https://vuldb.com/submit/908370
- https://vuldb.com/vuln/399669
- https://github.com/vgmstream/vgmstream/issues/1973
- https://vuldb.com/vuln/399669/cti
- https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e
- https://github.com/vgmstream/vgmstream/pull/1965
Affected packages
Git / github.com/vgmstream/vgmstream
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86515.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "139559631734300158753687368364948729195",
"length": 256
},
"id": "CVE-2026-86515-02403a1b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_decoder_close"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "109479269758029153256875655580620587640",
"length": 791
},
"id": "CVE-2026-86515-059044c9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/txtp_parser.c",
"function": "get_mask"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218306320849684813701766855721342919027",
"length": 479
},
"id": "CVE-2026-86515-12074461",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_decoder_open"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "82872687391934708622064143984111920656",
"length": 841
},
"id": "CVE-2026-86515-123a4207",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "range_decoder_decode"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"214331603036363686879150766694198220356",
"237850043238919794957190909887513918009",
"89553718493655151629220656083527750802",
"242266759566981918031508587054462373522",
"213839678410741450377477048009632766411",
"253433014255968633917119423141758674844",
"129016508413417096851664351936862430970",
"98179535299781809124922639380422652225",
"275832808981291020652508223608299125272",
"336708927117431318142628241590382384525",
"24544801646481661537945164432229328105",
"9316570060969502307572012209825108441",
"194179110966688474029975194595793922338",
"54971505997296314025559904122577997612",
"147153676452731356481543613055269370987",
"278505570640454947035990041104543993641",
"316247550851592296256780955812713199739",
"149819232250686342038043637423583987057",
"30889780792372435130968231275212773614",
"147218693061622710532629459065128028227",
"101985307724260786055986907083573265075",
"25411933205159105504621409530388486415",
"138132835316363491602155760786910244939",
"125762339220467604347213552878912956345",
"261364025552775035394976394648967839415",
"92415820280134020170083433996608906905",
"26646651449450032420218379201068943461",
"8661318705816985511462074551325427591",
"181476709887762508826230817405861808096",
"46291107361918268776029284559979423962",
"115616346755552882411527156920036163012",
"180965165990095275133525416592752577856",
"119909363298956687281649070968837944556",
"289083511249843929330933620140524770686",
"312259117271990568673383644495191190355",
"169201807683473966210438444867248520403",
"51057537835967236278538940929797553543",
"233767392279259697544270792370693569164",
"202208684308798146672465325475464188502",
"223374529626154734446952337689195670240",
"133182603138625126302993431717163636849",
"74693045542063273469540578465841118668",
"137989698812184652690379460955705614440",
"252854400539036130245760996390499823133",
"21867119750784048021209090629676685201",
"35648805539580237271106392938680950760",
"33258328062974851698843850957626857510",
"245016842932573824050637645809367842952",
"65712980002271214620954670279774636161",
"302406403042767041772046603467804507240",
"186155165331943431852211412903370475564",
"109827957629004324281262884645820641436",
"318359371486756336999858505561113355125",
"241930940625404592824561391294740106964",
"307123406564384200844892359789958515176",
"95379168323984403092140304204683640450",
"301407281970933787980902205026464604773",
"194742946684279403495416826474323776906",
"231850362194611550667483227510982803605",
"33469721543505131352213988226597456714",
"215990229795085374062832214426587578593",
"259434497429041014971755042417979245789",
"295864142730101863311206329648426090626",
"285391235812790962890436788649121317716",
"261129599683619649607040111462122722596",
"33362077387523597947074012030626109505",
"152553654691840628579992221081697844539",
"132252758753970886394804593962136613376",
"270225414666796510792916691989180293816",
"45159406071803383679825951284513036768",
"332972354839148535390635352741511376793",
"187062725516008987582145609229461140164",
"205641338493469013675962622432766044775",
"301525623946050075368325120771743601742",
"44047735587904653491850474897970448037",
"185934908914935047610554936658170819854",
"93427912347786309139063988391299335276",
"292539128288448054422021615891600839580",
"161832797745959843271622802081521384135",
"216936197184960653866800582043887118641",
"308988687843748848860452013223320757709",
"18194954297832407808366363128442284182",
"339837133916169212221410882216501497406",
"303527184725785973791284313680127217141",
"333612812162248863185849086296786261735",
"246715662631364376224746080932507186193",
"105150614962236514610396361613678158431",
"170792376460821589367886595408522565757",
"67966467043272767982782950944070192597",
"77812815503561491589639227470604452855",
"107834596004717330922204911613687859285",
"37350488608938293720161031192496270758",
"310658259437901356529721947657734581918",
"160638114536468687058669518670240882891",
"80161686766729604898104146475380550901",
"81847615795012635670055980763598578729",
"279141565300628071292647485978087603330",
"156140180459499362956367939824878864743",
"288289722647625233212815439862865783902",
"196109544616072148422334389991221384781",
"229856773849023758422705676521452051453",
"101496791203602763375279845082247978524",
"240896898520919198138488077836237965354",
"96560151838634171721591358630613130156",
"44582176744669841737926627968200099767",
"61610498341112610647225193947173911426",
"141516724724191532363054688757880975543",
"195135560236126244670188206994200507253",
"254820874812640477237477246798524928006",
"270223109508815385235781101550128691110",
"196494597431235861584633183796604325241",
"305633989769417510870200843868905105525",
"169656328256007983873983104672879523373",
"101125245629459318004050106246776282939",
"146328363588377094662522751881477139308",
"200968343515496063678351015305828417177",
"280683147996129588135546241043451315937",
"147962804866053058621075484834693458018",
"9209114484160242327656609981296285855",
"122175700522206175303836589727012782603",
"37132713023226217365953752907711741730",
"133692601418148932524745752579036852399",
"53070873942082439832547167868797450869",
"158884205773982926525967976149586196185",
"136953578220907097036151745334898746891",
"230734278939189143890100631334780584041",
"182877667084497249688496597377450525699",
"53390684346071449642751688881856621252",
"202528767318703742598044631185893313956",
"56274752101435596100157948501963053771",
"228505141322691345778713356693735126231",
"43933706803665109734992359093369637938",
"119037311171283548294324203671563912863",
"381826309782453239526879525788100733",
"38406602641410349449787946754783523748",
"85546237622343396834192649964849601816",
"172227233272494962566319930518848745892",
"340246452982153377439215776050583544958",
"246497460747789407087658891749443223997",
"143071983463669475290659740059369204514",
"262850150457358186630267288533138416498",
"255401510137180794608352081936442268867",
"4327615800576737097922548664506057151",
"45025692857256838450885907031223487986",
"46385078522929326036113072661845619204",
"116193901683320446057005339818642568914",
"252319061969552785597356450668836550686",
"264700417815175751624036880942994171467",
"129458159657634620297279180544362240726",
"203511918800616285270562861551848762199",
"285686171651302139224909011938529812442",
"239843979922509058861608990470244090013",
"46477499966577017352247891351596322891",
"313766683838244425025861965136650365544",
"45823390107482847815965987251040849056"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-165ef097",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"269197622381403366364524668659427915604",
"100769939109969292714593150370250764560",
"31165904473998130177727440837045666422",
"334634913948372968154801749775172163913",
"165295493993566790992816781078475676916",
"272117505262722634785266113613096971020",
"147528557299167568264518806559217400634",
"64376793514354509734564828676960800007"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-19a5693c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/mio_erisasound.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "291649727382025013415608485996044594465",
"length": 1558
},
"id": "CVE-2026-86515-1e6bd7e2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c",
"function": "ealayer3_parse_frame_v2"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "158990258679748826578556424181729399376",
"length": 1247
},
"id": "CVE-2026-86515-23e322d1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_decoder_decode"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "12896741813572753192669158699446849582",
"length": 635
},
"id": "CVE-2026-86515-2455c01b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_eamp3.c",
"function": "mpeg_custom_parse_frame_eamp3"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "273422853025232649410559999997296961485",
"length": 1171
},
"id": "CVE-2026-86515-3a77ee8a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c",
"function": "ealayer3_parse_frame_v1"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "174056249719679609563313768933286720990",
"length": 2519
},
"id": "CVE-2026-86515-3c08ae16",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c",
"function": "ealayer3_parse_frame_common"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "215461874663467904389195273969855630905",
"length": 699
},
"id": "CVE-2026-86515-42740f12",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/nwa_lib.c",
"function": "nwalib_decode"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "284420639922782138890798022732372567237",
"length": 552
},
"id": "CVE-2026-86515-4879f9e4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_decoder_dequantize"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"7424779268122598795968505351068582151",
"330233325428719232042025281591691469925",
"133550708849577210804854061716915148806",
"141525424591739284595207708290725697721",
"147089458639802815263456502686772242693",
"297401512509784375431515322637447284686",
"166899902858029329227098086261548658551",
"233145883001665657096013563962745552187"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-49ec3496",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mp4_aac_decoder.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "308620171255460731941726201543836130175",
"length": 2986
},
"id": "CVE-2026-86515-544dd81b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_decoder_transform"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137890416397665072622198369230920475361",
"length": 392
},
"id": "CVE-2026-86515-59644618",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_eamp3.c",
"function": "eamp3_skip_data"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "69464234870354940994094201272595670325",
"length": 14093
},
"id": "CVE-2026-86515-5974b913",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/txth.c",
"function": "init_vgmstream_txth"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"238586594269058207802337936518492191748",
"160628738339553114212520474365221956082",
"188202660033165324563877101599422542794",
"311033630059483025020052618110317261392",
"120815634249497485377887650644991183415",
"112707378054412767602941802772330629433",
"265814103854309723425602544627276437548",
"17337203415251422694823948962609958772",
"273044645211350846033584871890401335473",
"122536071528671578148848756407211005237",
"5728739456709762309720650188427719055",
"315432011654495300302635354065680463638",
"192827572692281055754842206805939126991"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-59cee761",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/speex_decoder.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "149747177207587516945109476536259161681",
"length": 2685
},
"id": "CVE-2026-86515-5d2c086a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/nwa_lib.c",
"function": "nwalib_open"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "888839873226847684543913806575750593",
"length": 542
},
"id": "CVE-2026-86515-617d8249",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c",
"function": "ealayer3_skip_data"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "161512457339532842336081194333712997581",
"length": 885
},
"id": "CVE-2026-86515-62523ce2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_eamp3.c",
"function": "eamp3_write_pcm_block"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"2237351094625827662831327763223265899",
"7437411788180650239153536937223772817",
"309705144596588208776390948381809725651",
"40485080620774249433343078802643143513"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-65802e74",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/hca_decoder.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "318915983058117580728816886129714339403",
"length": 427
},
"id": "CVE-2026-86515-68aeb7d1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "zlib_init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "24210015437420672789958200086985638481",
"length": 1421
},
"id": "CVE-2026-86515-72681c62",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/imuse_decoder.c",
"function": "decode_vima_comp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "335000046422814704936722868621417124388",
"length": 3455
},
"id": "CVE-2026-86515-7e13a994",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c",
"function": "ealayer3_rebuild_mpeg_frame"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "21147978601259677705652332160248995491",
"length": 867
},
"id": "CVE-2026-86515-83028df0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c",
"function": "ealayer3_copy_pcm_block"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "274525907428645258358238274025478267786",
"length": 553
},
"id": "CVE-2026-86515-88bae228",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c",
"function": "ealayer3_parse_frame"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "28028993407767312459061000880787199783",
"length": 264
},
"id": "CVE-2026-86515-8b04f1a7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_codebook_reset"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125605596149071314448626042670074368443",
"93552781048524140119989133235719042852",
"290143386531328653990193203223167310726",
"58674068171634033084109605223522990991",
"209371479007308592622510004755299250862",
"329647589177119568467844716673792300924",
"109776196087214969235871893957103167244",
"142079006148477039082443040065365224331",
"20610650774046884306437586758341778605",
"276883707346295416819505727495628388688",
"202172465719160452427323806803776417961",
"77250453420349119451203525854485950351",
"48050472040537072827270445323343422903",
"337833955906060206672156351048541212866",
"187787724005637117665167523728474644852",
"180974954987296102151845677422962325525",
"82390368015676210170069580083790636581",
"294255152160644326731286271913330450013",
"300537042752074926836049530441342549008",
"177389408091055184008286464390634443632",
"213254554863306495018553959248778664190",
"100806762984625019482928099662225690540",
"44867324503743153800810616820259919403",
"131687236957183278820641501671672047359",
"193759564181185229192201463126910945455",
"167921172517854724119880752148215941467",
"140930008353835046446785205514383785825",
"291204488292746729153997914270247899183",
"90701770656260824134602938014959408723",
"58090374189065735762341974585378173811",
"302923197934626607310021710387623739638",
"74919442172935714728009081666551303446",
"236214855974124774045928805131449607077",
"231993038948447102462808595257409732352",
"159538874963186815889275376395891287162",
"264760804533377067914528076013418141663",
"142737115111800794433364966313138658928",
"118836537048456147972349773371734661331",
"42503560612147933083272286675628659523",
"9684782857403278091947065165410787020",
"104695115340952283409664766365230241177",
"32463329315788495854284086003477742827",
"147433525430683976858761733816125114421",
"320228349381242886437109792082229073606",
"22131032730081295082188824431256763700",
"302923197934626607310021710387623739638",
"101874163834335639761022147561764255211",
"233007977822294975805760966040371968653",
"111893133774292255010605258062312743626",
"59430870905224919002509451526828875056",
"335585726943554202137714258204542096272",
"169916175262863102532601722752737197413",
"302989857766994131519876578006832073924",
"279394731311730860074798560587110918475",
"117908840995503366400709020265268088286",
"141220803171845733577819004000500017382",
"58270594537250667432078208126411214417",
"197268623378297457329023478112263385744",
"38779559817685011491277956223102758220",
"185049462692018180669281980662611056186",
"289738600921450906126343260392880906151",
"296340648614617468302131569362468735090",
"107863567095639018626479303912385863913",
"275162662973317928594195681481832157867",
"113140711291992979858210201150925913580",
"38131907462517422988731005217767181624",
"309008200028523514835432247350991614990",
"144211810566358731916505033324278411683",
"280187822882014561862504896468606088686",
"148840733290983035563918333871774274447",
"301550197178239268330831868529282438259",
"166940666372307435173888419417966544201",
"94096933413894140633535152422352354532",
"65851824323776131252737505342631969854",
"152487210158309477725325723074756031088",
"282001679199043161858364357953956959623",
"167977636790461125682280046939865355109",
"224776132317321476290007832386067321434",
"141622832317561685823689054361790025025",
"333658404155062433714909864773627942691",
"175600940909505058415971174197096283302",
"125457118147053255297937324700997064095",
"169092585775750033096799358531730984942",
"239775046299584080794743563562244534799",
"113251565415558918202521372776803832882",
"220729492164905421570393686176029434070",
"112346673153926351409804648971187199314",
"155181145149433663646697728661257489588",
"282945576522887129750558125341870776669",
"284682936527538586878657423353044555418",
"78984854589314878136693580114060197",
"203765480690661749048393766863723452834",
"58090374189065735762341974585378173811",
"302923197934626607310021710387623739638",
"65618002359489058455864577450731006180",
"264960328859200761777610436965780228173",
"84931062746815101836605040033966091080",
"74214553007888403556470428619266701519",
"255360489414439423945456681030948755054",
"253561913789638415784053830461598695243",
"62750523505301404780920405080997759748",
"252940338227314848614190685825515980033",
"36308199535823930359547395829469021626",
"197696461180520545235730784554836825341",
"58090374189065735762341974585378173811",
"302923197934626607310021710387623739638",
"312460221674189582284219442825228555076"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-8cb23c5b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_eamp3.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "28566635320958323097067185012668169231",
"length": 1287
},
"id": "CVE-2026-86515-91a2bb72",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_codeinfo_parse"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "69889422602515332083411523119996834662",
"length": 435
},
"id": "CVE-2026-86515-924c4a32",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/vorbis_custom_utils_sk.c",
"function": "build_header"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "301870652503338944411386654550683221784",
"length": 5834
},
"id": "CVE-2026-86515-9b5af0e4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/mio_erisasound.c",
"function": "MIODecoder_DecodeSoundDCT_Std"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "230397032984698408523657908261863931550",
"length": 1048
},
"id": "CVE-2026-86515-9e3860fa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_decoder_block_setup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "11780611643184177823761481664396384424",
"length": 1040
},
"id": "CVE-2026-86515-a878fa31",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/hca_decoder.c",
"function": "init_hca"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "113388322942469513081707867062715553571",
"length": 1148
},
"id": "CVE-2026-86515-ad243df2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_eamp3.c",
"function": "mpeg_custom_setup_init_eamp3"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"290526940792817135678485191427675882984",
"52677055213520356455494298710707035521",
"50184689649637776034998106828235770442",
"71448645966859914328246927381365666951",
"74136016091432306527344398894198673626",
"334608784844877695946162452919602721907",
"204139790583118617326651683055006014523",
"40714425411135108469609696965841777147",
"227109887960292711573703946634754971988",
"289145179610307409668390403463041741392",
"319829529571756011054733592791652593951",
"260862501352381103440041054832853618959",
"149641367904849611519277145000865254811",
"195628360162295186052164735575341414161",
"32848815488405787753554063830885466278",
"144189171307497919508118508585891165275",
"102600164178381832978217011335220439623",
"250695193499252117004869160898779132770",
"204750472415113349994257979333063939817",
"270206241241976942816516614359490556139",
"327491709728536095202910771668448904794",
"337380813999581345933715414903398300060",
"291044736884053381037158556155494327772",
"170917788264739184340545829496274241647",
"117708714274826091195090466536218434929",
"56404085422033392924747632478542319649",
"331284535817485221770946080022876279188",
"94160860263875538453776392724063218006",
"333298614909098923444715245722688433571",
"268479175634656592896243885195853115834",
"86135379761678996508661375276322952771",
"234646678729608998217804387999208141108",
"126509010437469685105443054682390692507",
"331166324154989688223820474547858344192",
"156808843085858839871924975843863025853"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-ae77c9fe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/txtp_parser.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"82619600219153649988459536021450240329",
"151780218925018506224469161838982868439",
"285715955662043360260734917905995290237",
"303078780446471724847476382901203648557",
"61326644730016947842226699525767416639",
"31732630040307707053153682434645377403",
"314968787757159608637417657508810771454",
"187658881106413039184063685001914639497",
"80522486161667639601355533710352803443",
"286965322964105169269872316316616287146",
"150159293342801587918109154911481979267",
"73959154039915894088979417674681729839",
"309616880896087889263069465849421793005",
"33148893965183000658824563714917345343",
"54087219875828170506650453826539046969",
"231060375491758650865672355861914013154",
"100950958026630468560997631941642018737",
"32755789946686176762143621440996408058",
"122788943517023705467380849293991781345",
"55770786811465153105542125622406506441",
"53782182229818098288032654752111617992",
"302923197934626607310021710387623739638",
"73538906557549218873860691178548591754",
"338364915367314961897679547132590020820",
"248830324289726753123947563837082505908",
"36867975553647373147404014560387470179",
"40999985753127742003669098084212121342",
"220897053819624541477872290664514245116",
"57103695602354873651056810959078065252",
"212464472623535072115318736554834878077",
"74849481797280595739227838618314257707",
"25081591202983728116073977619622425282",
"114299650219482749273655382400599432521",
"339633688106426365206754378173255165026",
"293736033686845930815004240705555119547",
"49324532815117694447977753242787800621",
"38980018427726830351267865317260412244",
"257632959553286064800877978573382411529",
"296645910900487545437329354805247613569",
"238484921104011992804001466403245826718",
"98179468485876291789916941591168847114",
"321360508026138879503889107826755238166",
"134350244930581751013429990399645383316",
"67479072935294807979069523477855603248",
"102879117642557473703492077142530522688",
"302923197934626607310021710387623739638",
"178929718702363474177496825770856127078",
"336604348005556141407746192478755568165",
"64566453918314455915347663320757085428",
"142385405033430912521620963535282445474",
"7506403097221865495189533510478413382",
"193722930725269735852583392246350135619",
"305808036158512151394036652003022770289",
"154381892816250960288724049921904875726",
"64659886939977030955580301019423792221",
"118266806401533135879265450731864723037",
"335067778977963944632807964501119179862",
"96240513123959569625798491503764817369",
"112916674215835625472412349546300706577",
"58661462247842496599155587891983532558",
"194661316267501673660821122112221438255",
"95788717479006002502480412004393290119",
"58090374189065735762341974585378173811",
"302923197934626607310021710387623739638",
"208480508638868387243694233270549311955",
"235215632001056125175775084192979609967",
"29164528799788144029670438520879591654",
"237373923873956416182229604451807032810",
"255421009885523439331823849456036151438",
"144450522252057271549134263901150991482",
"151395754642234628380239034263851295142",
"47573865773973331928908933677123207035",
"280938898965573481300367869082913346290",
"292580503123011439444316325785080818409",
"264291639301752803928345714503233815634",
"246373057771978605556066535233838525903",
"110894133016237266449427612028697087574",
"255544717450582523548902547862417033641",
"155809230787061806901821959469024826609",
"165747971703181275990227998016348612127",
"273221573540666615704780662759749944069",
"119301374348551632283281326100755794207",
"337556944085717132517914141796002571352",
"269892935955032607236658605436914683292",
"301938578191833972665739074689905695352",
"120837971982088865739331946257600681902",
"259937136569364237502415487251707541699",
"286036186470312940221216103562286902744",
"190473222385581993747154733650572695673",
"66833971672501720692429778665821791051",
"163675622671307448693795748729738025244",
"215471962358446482397788702572085404591",
"25296283374864349801035952948795753937",
"266568013436576731686935510353770979212",
"267392275038721940775157609766873310464",
"302923197934626607310021710387623739638",
"55462813980728108839199633381358623535",
"326067538195170740863532905164584508983",
"208399517411711637201102226773705902859",
"126104675261550686644184041054504898310",
"37631367395862394923508231961430447805",
"37761358260397408707015958162402265890",
"26908429825105563703468570449003176847",
"43317046127151745421312841926952920809",
"205518077861288783475428326694673757127",
"135260561558471565954868492421046510937",
"172756835041273219420798857631249356618",
"107395768387380286515088267700910461354",
"199914724891330357443906016890188642006",
"113859722644129812104101266164671312581",
"318736128273232950521404698895433577238",
"18895010397300850180211501792464678180",
"32649360893814284068976966078379723718",
"127958404577479280290012924943909217135",
"119165615928051294753963722030060243781",
"308560117630613174464849986344041309107",
"83153185106831433484008950837315695887",
"63380972583830407189777229023589473267",
"222499384036458946375235338679407097259",
"97244960676669728825476522394170786032",
"243661536138093570957241803615719568706",
"130542488422474692553650393847704164476",
"331374594875286757728608999842235522644",
"25811877873142257307176111297820450922",
"72032561239510587518892835993705851176",
"311654811734673722362730957228899971088",
"55287049252317841685245118390561205305",
"205285607054155881832462906166403099054",
"115651370865717882048489740086705702963",
"127829229344140195768300011698928886621",
"23933539349643025234786285623590090822",
"181103608460372462204333921797421998528",
"81075461854790872149156080821276103469",
"172992107951175280700759473705432795518",
"69383776625083475877821120979998745548",
"329281699408716531839387775361378216565",
"100981045309924623531833717877257960732",
"14690579208181501932500017379638599146",
"331374594875286757728608999842235522644",
"25811877873142257307176111297820450922",
"72032561239510587518892835993705851176",
"311654811734673722362730957228899971088",
"1887015768759825477522152103818612760",
"162338801296280928348365687442268588118",
"302783100927061941101281178933653878093",
"302923197934626607310021710387623739638",
"130690510646136937783670347995572491357",
"138142620266614360800549101698864212965",
"116354279383862751516397038879503312655",
"58697018864430474364544335742267003887",
"316100311665514394679032285212113521256",
"326977429780452321673317834227261948462",
"66785812555853271586576945890615252834",
"12785456664891618718927217003496688090",
"324788538531201391519258297101790636978",
"445988938466722286037789332922989621",
"21645652936773359951387855977506259691",
"257203405490646782728189667506570061877",
"95603048139241607624990092367162303521",
"252485418063205295630620114451365513161",
"319157783416623313813755901499099487626",
"160382476656237707041327438684640075774",
"233746793288135734249636505155629368925",
"281107452854709282156196208138625424767",
"48695820990387424755850475419632048187",
"298245870809747209980467687934711537520",
"229421821756469727663954365005994625284",
"143289299144684164268576294435343237617",
"312809972533067646303267524662605703479",
"288914186134226989295237960922178665643",
"47254673360148625972153833916172587718",
"63525900359397585003829586878082537120",
"229128988292098612200143666543638049037",
"335823611262665251137655463539098353757",
"58090374189065735762341974585378173811",
"302923197934626607310021710387623739638",
"339834529202946090968947972849683652446",
"17952324263380594858629806305439672958",
"72499405974507925989439015645942240724",
"252388730424385626936854991497762822134",
"307106416299521692075804896389810777709",
"31147177159331333453382853740990262423",
"62499364620709212514854845070127892451",
"273607417037932500562617067358094536667",
"7821920080075924330966603921304731995",
"6973073375716739987213590248639554635",
"326428037766521430271200463707234801588",
"64061245284969588155164017183804195637",
"136202609547807170277617970758854524408",
"326901839598071079456923968165954942026",
"314207671478624617230921945839845752041",
"103631613930786076796349656365524544995",
"107992815692580129087855863547441455873",
"58090374189065735762341974585378173811",
"302923197934626607310021710387623739638",
"81321358401178950761501403850908315987",
"73722998698258428407047320787735357548",
"79871617975227009719846120875944675875",
"242332368356205028885718243415978418681"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-b41cab95",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "97690707275655714282844413747332987132",
"length": 1614
},
"id": "CVE-2026-86515-b9692c41",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/txtp_parser.c",
"function": "add_group"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "130860037300136343018154310625201026407",
"length": 888
},
"id": "CVE-2026-86515-ba241d4c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/mio_erisacontext.c",
"function": "MIOContext_DecodeERINACodeBytes"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "47449075223036291322720265578806544840",
"length": 1613
},
"id": "CVE-2026-86515-bfb5b0e5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/ubi_bao.c",
"function": "open_memory_bao_spk"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"123504500487074886835908868846128954502",
"325660362459751401148099950955046028552",
"208869519917449446471960362574825750274",
"48212977941885801573830981117427469350",
"179806379974895701003809067160118078436",
"338738801892077150734776304003794657626",
"93325004181047036633597056910463192785",
"312701676792005145947121797377517393607",
"58860968887797983315282301365168885578",
"51714630385016749500033830683882877976",
"34263335963523419733273366886263544509",
"307306441326021023158187535638085810311",
"210262056873529558100472267514662996909",
"78304509106159206352370960888910893719",
"48905824697267794001106801496118569413",
"295992110354727450493744078091839686078",
"191766618910390088239384763589657216030",
"35151127847683304161819814178804085942",
"127279848707095058105650098387599246562",
"244044220381102696078315909757898230117",
"160296876655360323164211657679595397479",
"161062896407301932090010916388909517671",
"310943434244908924986320625461344228705",
"337418436161074901970380064043995334861",
"63326114386501416317305841888137048058",
"11434074054383442481947560002967744907",
"327074035054086742960250102027789442423",
"106395990270394174880101032973274776117",
"62532682986867663093046679128535528853",
"297044816391235773122540701323811310987",
"216764730583861330745062856406002843671",
"90619870422253310111774705875535583477"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-c6e02685",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/txth.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"317649225664258274306618257127862300809",
"9516036261572525890749783749544903172",
"277165808367973176607166110932028704763",
"194544954840228617489150327426242032079",
"140171530748273310521616651708309063605",
"147012811183404331597300858915238174190"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-c85a1f1a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/mio_erisacontext.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "1477369684463677558943545124071311614",
"length": 1425
},
"id": "CVE-2026-86515-c9e3575f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/txtp_parser.c",
"function": "add_settings"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "300083399562803000700711049504674676385",
"length": 395
},
"id": "CVE-2026-86515-cb269929",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_codebook_get_qbits"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "39586689346822650194616527457929447070",
"length": 688
},
"id": "CVE-2026-86515-d06aa8ed",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_decoder_reset"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287253014620496264331493885451563173295",
"length": 2703
},
"id": "CVE-2026-86515-d0ab61d7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/txth.c",
"function": "get_bytes_to_samples"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "219703678863898009039251917032431688313",
"length": 1878
},
"id": "CVE-2026-86515-d3e9cf54",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mp4_aac_decoder.c",
"function": "init_mp4_aac"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "255601505069757618974442145448085324546",
"length": 1195
},
"id": "CVE-2026-86515-d75f2dcf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/meta/txtp_parser.c",
"function": "add_entry"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "145839367510578394620607538747626212923",
"length": 1065
},
"id": "CVE-2026-86515-dbe5fa8a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_eamp3.c",
"function": "eamp3_parse_frame"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"225197644107162689785916386746573736000",
"289667425630749775854764682648105143769",
"216464409282419945508998070235427208218",
"266983947778749845349893667163576844661",
"119708519272468022277755829432719739869",
"168320705105965085592212170504956579555",
"59789003773379207081361878486459688000",
"313656677337232643803418689258479891370",
"295440577095471192316105154519562530672",
"92105991022063255985332519462774271538",
"325967630689752680729676967508666069614",
"86984398277966379781371113453684268720",
"237847733320269452163277951760848339198",
"247417161290032534146550607818371229941",
"112815975696108032663784212928595093459",
"167982115454838064119181093523742505814",
"170625830187787717190162977671270975960",
"119640981010526227137093389171137752129",
"306567238062639865463591299026844708461",
"152038743130381248747384908372857505468",
"1924596163967612540023765763452272702",
"125818910957575218055649610170782806702",
"290485198612972683847216963573764117414",
"290849655875731237003592444456297529498",
"107435911182207513442817612887317546777",
"126614016084339408336603095985603874063",
"302787712357975260389347786170491162550",
"243786614620461289266633033962069876989",
"102774601311053464898581946233252085118",
"265860777968598775880490782489832745544"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-dc17516e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/imuse_decoder.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "74624915707927793339550960649681591472",
"length": 600
},
"id": "CVE-2026-86515-dc46a2f5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/speex_decoder.c",
"function": "read_frame"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83730626824893933790337213574712224729",
"316775721999490003656149237303809918827",
"248581818576156665538885450566538449255",
"69290303493870244315356296517329531253",
"198383020848267863480519398591789097497",
"139489331545836084981772404731220058400",
"129612859478514095720973453738583147975",
"182065928596488743068901666530509620461",
"316967879018532646243219521253361966872",
"51466499501523178109451789265981088621",
"286961812397530760505762465681956395505"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-dc95c2e6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/nwa_lib.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"12897165002779916984163955666398838655",
"8967700105886283669942823361026379799",
"272453002762348212130618754311620642356",
"86094127428295568809408865361965628319",
"262940289300369958956191831638615252204",
"38441436802915001416902686228934504191",
"103801750709793854534493773739506408355",
"325910371220594432953423351700931665673",
"73946691493881363174491082446298403171",
"154371057541383928367047328234732435127",
"310210021778235882381216317131704314152",
"164090718858450579921393473364151188395"
],
"threshold": 0.9
},
"id": "CVE-2026-86515-e0d852bb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/vorbis_custom_utils_sk.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "303624820633402831946433955520404882635",
"length": 2236
},
"id": "CVE-2026-86515-e2956faf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/mpeg_custom_utils_ealayer3.c",
"function": "ealayer3_write_pcm_block"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "322705883002755758637373042042280636695",
"length": 386
},
"id": "CVE-2026-86515-ec9c3f78",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/imuse_decoder.c",
"function": "decode_data_mcmp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "245242578294016452650762211450283406193",
"length": 374
},
"id": "CVE-2026-86515-ede9b30c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e",
"target": {
"file": "src/coding/libs/icelib.c",
"function": "dct_decoder_ms_stereo"
}
}
]
vanir_signatures_modified
"2026-09-30T08:06:55Z"