{"id":"CVE-2026-104679","kind":"vulnerability","aliases":["CVE-2026-104679"],"related":[],"title":"VOCALOID6 Editor: XML external entities let a crafted project leak data","description":"VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.","summary":"VOCALOID6 Editor from Yamaha does not restrict XML external entity references. Opening a specially crafted project file can make the product open unintended connections, leaking sensitive data from the machine or causing a denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VOCALOID6 Editor","fixed":["6.13.3"],"affected":"<= 6.13.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["desktop","mac","other","user-interaction","vocaloid6-editor","windows","xxe"],"not_affected_if":["no-untrusted-project-files","patched-6.13.3"],"how_to_check":"Open VOCALOID6 Editor, check About/version: 6.13.2 or earlier is affected; 6.13.3+ is fixed.","fix":"Update VOCALOID6 Editor to 6.13.3 or later (Yamaha updater; update Editor before voicebanks).","status":"open","published_at":"2026-10-19T09:17:06+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:36:05+00:00","updated_at":"2026-10-25T03:42:28+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-25T03:36:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"VOCALOID6 Editor: XML external entities let a crafted project leak data","impact":"medium","summary":"VOCALOID6 Editor from Yamaha does not restrict XML external entity references. Opening a specially crafted project file can make the product open unintended connections, leaking sensitive data from the machine or causing a denial of service.","category":"other","nicknames":[],"who_cares":["vocaloid6-editor","windows","desktop"],"confidence":0.6,"needs_auth":"no","worst_case":"Sensitive local data leaks or the editor crashes on load","analyst_note":"Check the Yamaha advisory and NVD entry for affected VOCALOID6 Editor versions and the patched build; the sources give no version or fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-project-files"],"who_is_affected":"People who open project files from untrusted sources in VOCALOID6 Editor on their desktop. Servers and applications that do not run this desktop editor are not affected. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000542,"input_tokens":3318,"output_tokens":421,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Yamaha advisory and NVD entry for affected VOCALOID6 Editor versions and the patched build; the sources give no version or fix.","search":"'-104679':14A,17A '-2026':13A,16A 'caus':62B 'communic':91C 'condit':117C 'connect':54B 'corpor':72C 'craft':8A,45B,82C 'cve':12A,15A 'data':11A,57B 'denial':64B,113C 'denial-of-servic':112C 'desktop':20B 'devic':102C 'dos':116C 'editor':2A,19A,28B,32B,68C 'entiti':5A,40B,77C 'extern':4A,39B,76C 'file':47B,84C 'improp':73C 'inform':99C 'initi':89C 'instal':107C 'interact':25B 'lead':93C 'leak':10A,55B,96C 'let':6A 'load':79C 'mac':21B 'machin':60B 'make':49B 'may':85C 'open':42B,52B 'potenti':92C 'product':51B,87C,105C 'project':9A,46B,83C 'provid':69C 'refer':41B,78C 'restrict':37B,74C 'result':109C 'sensit':56B,98C 'servic':66B,115C 'special':44B,81C 'unintend':53B,90C 'user':24B 'user-interact':23B 'vocaloid6':1A,18A,27B,31B,67C 'vocaloid6-editor':26B 'window':29B 'xml':3A,38B,75C 'xxe':30B 'yamaha':34B,71C","nicknames":[],"mitigations":[],"who_affected":"Anyone running VOCALOID6 Editor 6.13.2 or earlier (Windows and Mac) who opens project files (.vsqx, .vpr) from others. A crafted file can make the editor make unintended connections, leaking local data or causing denial of service. Needs user to open the file; skip if you only open your own projects or already run 6.13.3+.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:42:28Z","by":"analyst","run_id":775}},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104679","severity":null,"published_at":"2026-10-19T09:17:06+00:00","modified_at":"2026-10-20T19:17:20+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104679:775","url":null,"severity":null,"published_at":"2026-10-25T03:42:28+00:00","modified_at":"2026-10-25T03:42:28+00:00","first_seen_at":"2026-10-25T03:42:28+00:00","fetched_at":"2026-10-25T03:42:28+00:00","note":"JVN (JVNVU#93520490) and CVE record: affected <= 6.13.2; Yamaha 6.13.3 (2026-09-17) fixes .vsqx loading vuln; vendor page does not name the CVE, link via JVN. No exploitation or PoC seen; no social search done (local-file, user-interaction bug)."}],"documents":[{"id":3298,"url":"https://www.vocaloid.com/en/news/support_64/","title":"VOCALOID6 Editor Updater Ver.6.13.3 Release (Yamaha)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3299,"url":"https://jvn.jp/en/vu/JVNVU93520490/","title":"JVNVU#93520490 Yamaha VOCALOID6 Editor XXE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}