The vulnerability appears in the add_entry function within src/meta/txtp_parser.c of the vgmstream project. By manipulating the range_start and range_end parameters, an attacker can cause the parser to allocate an excessive amount of memory or CPU time, leading to resource exhaustion and service disruption. This flaw is tied to CWE‑400 (Uncontrolled Resource Consumption) and CWE‑404 (Missing File or Resource Access).

Any installation of vgmstream up to revision 2117 is vulnerable, including audio processing applications that embed the vgmstream library or invoke the txtp component. The issue exists in all releases that incorporate the code before the patch committed as 4b6a02dd.

The CVSS score of 5.3 reflects moderate severity, while the lack of an EPSS score indicates an undetermined but noteworthy likelihood of exploitation. The vulnerability can be triggered remotely by providing crafted data to the txtp parser, requiring no elevated privileges. Consequently, a remote attacker could potentially cause a denial of service on systems that process such files. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild at the time of this assessment.