high · CVSS v3 7.1 · CVSS v4 6.9 · EPSS 0.0013

CVE-2026-104679

Yamaha's VOCALOID6 Editor allows XML external entity references to be processed, enabling malicious project files to trigger unintended netw

Overview

Yamaha's VOCALOID6 Editor allows XML external entity references to be processed, enabling malicious project files to trigger unintended network communication and potential data leakage or denial of service. The flaw can be exploited by loading crafted files, affecting users who open or import such files. It is a high severity vulnerability with a CVSS v3 score of 7.1.

Description

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

Impact

Confidentiality is at risk due to potential data exfiltration from the host device. Integrity could be compromised if the editor modifies files or settings. Availability may be impacted through denial‑of‑service attacks. The primary impact is on musicians, studios, and any users running the editor.

Remediation

Apply the latest patch released by Yamaha that disables XML external entity processing. If a patch is unavailable, upgrade to a version that implements safe XML parsing or configure the editor to reject external entities. Additionally, restrict network access for the application and monitor for unexpected outbound connections.

Risk context

The vulnerability is rated high severity with a CVSS v3 score of 7.1 and a low EPSS of 0.0013, indicating a low probability of exploitation but significant potential impact. Defenders should prioritize patching or mitigation to prevent data leakage or service disruption.

Affected products

  • Yamaha VOCALOID6 Editor

Scores

Severity
high
CVSS v2
6.6
CVSS v3
7.1
CVSS v4
6.9
EPSS
0.0013

XML External Entity Yamaha VOCALOID6 High Severity Data Leakage Denial of Service Patch Security Update

← All CVEs

Related CVEs

high

CVE-2026-112107

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis

high

CVE-2026-108121

CVE-2026-108121 is a high‑severity flaw in SME Server 11.0rc1‑215 that lets a privileged user inject Apache directives during domain creation. The injected directives corrupt httpd.conf, causing Apache to fail to start after reboot and leading to a denial‑of‑service of the web server and its virtual hosts. The issue is exploitable only by users with high privileges on the host.

View analysis

high

CVE-2026-112081

A deserialization flaw in HanLP’s load function allows remote attackers to supply a crafted classpath argument, potentially leading to arbitrary code execution. The issue affects all versions up to 2.1.0-beta.64 and can be triggered via network interfaces. It has been publicly disclosed and remains unpatched.

View analysis

high

CVE-2026-112082

The CVE-2026-112082 vulnerability affects the SGLang library (up to version 0.5.19) in the Expert‑Distribution Recording Endpoint. It allows remote attackers to trigger a denial‑of‑service by manipulating the Scheduler.expert_distribution_handle function. The flaw is publicly documented and the fix is pending merge.

View analysis