A stack out‑of‑bounds read occurs in the G.722.1/Siren14 decoder of vgmstream. The bug is triggered when the decoder’s bit reader refills without verifying the end of the data_u32 array, allowing an attacker to read beyond the intended buffer. The resulting application crash violates integrity and availability, potentially causing a denial of service.

The vulnerable component is the vgmstream library, published by its maintainers. Any software that incorporates vgmstream – such as games or multimedia players that decode .s14 or .sss audio files – may be affected. No specific version range is documented, so all releases prior to the fix should be considered vulnerable.

The CVSS score of 4.8 indicates moderate impact severity. The vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. The EPSS score of < 1% indicates a very low probability of exploitation. Based on the description, the likely attack vector is local or remote file injection using crafted .s14 or .sss files. The vulnerability does not provide remote code execution or privileged escalation, but it can trigger a crash in any process that processes audio data using this library.