Multiple vulnerabilities in Yamaha VOCALOID6 Editor

Overview VOCALOID6 Editor provided by Yamaha Corporation contains multiple vulnerabilities listed below. Use of hard-coded credentials CWE-798 - CVE-2026-76131 Missing authentication for critical function CWE-306 - CVE-2026-76137 Zero wasthatzero.net reported these vulnerabilities to JPCERT/CC...

CVE-2026-76137

Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe...

CVE-2026-76131

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

EUVD-2026-63799

Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe...

CVE-2026-76137

Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe...

CVE-2026-76137

VOCALOID6 Editor exposes a local named pipe without authentication; any process on the same local user account can send commands and escalate privileges. CVSS 3.3/4.8 reflects low-to-medium local-only impact; no exploit code or in-the-wild activity is documented. Users should update via the offic...

CVE-2026-76137

Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe...

CVE-2026-76131

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

CVE-2026-76131

Hard-coded credentials in VOCALOID6 Editor allow network-based impersonation of the legitimate client, enabling unauthorized access to Yamaha's activation and content servers. CVSS 3.1 scores this MEDIUM (5.3). No exploit code or in-the-wild exploitation is documented; monitor Yamaha and JPCERT a...

CVE-2026-76131

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

EUVD-2026-63798

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

PT-2026-79282

Name of the Vulnerable Software and Affected Versions VOCALOID6 affected versions not specified Description VOCALOID6 contains hard-coded credentials, which are fixed passwords or keys embedded directly into the software code. This flaw may allow an attacker to impersonate a legitimate VOCALOID6...

PT-2026-79283

Name of the Vulnerable Software and Affected Versions VOCALOID6 affected versions not specified Description A missing authentication for critical function issue exists in VOCALOID6. This allows any process running under the same local user account as an active VOCALOID6 Editor instance to escalat...

CVE-2026-76131: Use of Hard-coded Credentials

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

CVE-2026-76137: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe...