A stack-based buffer overflow exists in vgmstream’s sscanf function within src/meta/txth.c, affecting the txth-txtp component. The flaw allows an attacker to overflow a stack buffer and potentially execute arbitrary code. The exploitation path is simple: an attacker can remotely supply crafted input that triggers the overflow, leading to memory corruption and control‑flow hijack. This translates directly into remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

The vulnerability affects vgmstream releases up to revision 2117. All installations of vgmstream prior to applying the patch identified by commit 4669d37a6af94866f6f0628678f9f90d46954e8b are vulnerable. The component in question is the txth-txtp module used during metadata parsing.

The CVSS score of 5.3 indicates moderate severity, yet the flaw is remotely exploitable and the exploit code is publicly available. The EPSS score is not provided, but the vulnerability is not listed in the CISA KEV catalog. Attackers can abuse the stack-based overflow (CWE-119, CWE-121) to gain arbitrary code execution if no mitigating controls are in place.