A flaw in the parse_mus routine of vgmstream’s mus_acm.c leads to excessive resource consumption when processing specially crafted input. The vulnerability is an instance of improper input handling (CWE‑400) and a potential off‑by‑one error (CWE‑404). An attacker can exploit this by sending a crafted file to the affected binary, causing it to allocate large memory blocks or perform excessive CPU work, resulting in a denial of service.

The issue affects the vgmstream media decoding library for all releases up to and including revision r2117. The affected product is the open‑source vgmstream binary; any deployments using these releases are vulnerable until the patch identified by commit ae37662ad626254ddd96ad69ac263792d7a92024 is applied.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, so the exploitation probability cannot be quantified, but the lack of a known KEV listing suggests no widespread active exploitation at this time. Based on the description, the attack may be launched remotely, and no authentication is required. An attacker can trigger resource exhaustion without interacting with privileged accounts, causing service disruption for the target system.