Live › vulnerability › CVE-2026-104679
Go to dashboardVOCALOID6 Editor from Yamaha does not restrict XML external entity references. Opening a specially crafted project file can make the product open unintended connections, leaking sensitive data from the machine or causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running VOCALOID6 Editor 6.13.2 or earlier (Windows and Mac) who opens project files (.vsqx, .vpr) from others. A crafted file can make the editor make unintended connections, leaking local data or causing denial of service. Needs user to open the file; skip if you only open your own projects or already run 6.13.3+.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VOCALOID6 Editor | vendor | <= 6.13.2 | 6.13.3 |
Open VOCALOID6 Editor, check About/version: 6.13.2 or earlier is affected; 6.13.3+ is fixed.
Update VOCALOID6 Editor to 6.13.3 or later (Yamaha updater; update Editor before voicebanks).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.
This page as .md · .json · in your agent: get_signal("CVE-2026-104679")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.