The vulnerability is an unbounded compression-table index in the libvgm PCM data-block decompressor, leading to a Heap Out-of-Bounds Read. When a malicious .vgm file contains a small type 0x7F table and larger compressed values, DecompressDataBlk over-reads heap memory and crashes the consuming application. The read does not directly modify memory, but it can expose private data and disrupt service, resulting in a denial-of-service effect on any consumer that processes the malicious file.

ValleyBell libvgm is the affected component. The issue exists in the code around commit a6eed945, which is used by consumers that employ PCM data-block decompression. No fixed version or affected-version list is provided.

The CVSS score of 6.8 classifies the vulnerability as moderate. The EPSS score of <1% signals a very low probability of exploitation in the real world. The vulnerability is not listed in CISA’s KEV catalog. The most likely exploitation scenario involves an attacker delivering a crafted .vgm file to a user or system that processes the file using libvgm, which would trigger the over-read and cause a crash. The lack of an escape or privilege escalation means the impact is limited to denial of service.