CVE-2026-86514

vgmstream (up to revision r2117) contains a stack-based buffer overflow in the sscanf function within src/meta/txth.c, part of the txth-txtp component. The flaw can be triggered remotely without authentication, though user interaction is required (e.g., opening a crafted file). CVSS 3.1 rates it ...