The vulnerability in Yamaha’s VOCALOID6 Editor is an improper XML External Entity (XXE) handling flaw, classified as CWE‑611. A crafted project file can cause the editor to resolve external entities, triggering unapproved outbound connections. This can lead to leakage of sensitive information stored on the device or to a denial‑of‑service condition if the application hangs or crashes during processing.

Yamaha Corporation’s VOCALOID6 Editor is affected. No specific version ranges are documented, so all currently installed releases of the editor should be considered vulnerable until Yamaha releases a patched version. Users should verify the version against Yamaha’s support site and upgrade if a fix has been released.

The CVSS score of 6.9 indicates moderate to high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, attackers can supply a malicious project file that the editor will open; the attack can be performed locally by a user or remotely if the file is delivered through email, a shared network location, or other file delivery mechanisms. Because no active exploit is known, the likelihood is considered moderate, yet the potential for data leakage and service disruption warrants timely remediation.