{"id":"CVE-2026-120386","kind":"vulnerability","aliases":["CVE-2026-120386"],"related":[],"title":"Effekseer: crafted effect file can crash the host process","description":"Effekseer improperly validates \"effect\" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash.","summary":"Effekseer does not properly validate effect files. Loading a crafted effect file into the affected runtime can force the host process to crash, which is a denial of service.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["effekseer","game-engine","package"],"not_affected_if":["effect-files-trusted-only"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","triaged_at":"2026-11-09T08:25:55+00:00","updated_at":"2026-11-09T08:25:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T08:25:55Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Effekseer: crafted effect file can crash the host process","impact":"low","summary":"Effekseer does not properly validate effect files. Loading a crafted effect file into the affected runtime can force the host process to crash, which is a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["effekseer","game-engine"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"host process crashes when a crafted effect file loads","analyst_note":"Confirm affected Effekseer versions and fixed release from the linked patch and release notes on github.com.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["effect-files-trusted-only"],"who_is_affected":"Applications that load Effekseer effect files, including ones supplied by users or third parties, are the ones exposed. Teams that only use effect files they build and control internally are less exposed. The sources do not name affected versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":4502,"output_tokens":397,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120386':12A,15A '-2026':11A,14A 'affect':35B,64C 'craft':2A,30B,57C 'crash':6A,43B,73C 'cve':10A,13A 'denial':47B 'effect':3A,26B,31B,53C,58C 'effeks':1A,16B,21B,50C 'engin':19B 'file':4A,27B,32B,54C,59C 'forc':38B,71C 'game':18B 'game-engin':17B 'host':8A,40B,67C 'improp':51C 'load':28B,61C 'may':69C 'packag':20B 'process':9A,41B,68C 'proper':24B 'runtim':36B,65C 'servic':49B 'valid':25B,52C","nicknames":[],"mitigations":[],"who_affected":"Applications that load Effekseer effect files, including ones supplied by users or third parties, are the ones exposed. Teams that only use effect files they build and control internally are less exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["effekseer","gameengine","medium","package"],"campaign_type":null,"search_a":"'-120386':12A,15A '-2026':11A,14A 'craft':2A 'crash':6A 'cve':10A,13A 'effect':3A 'effeks':1A 'file':4A 'host':8A 'process':9A","search_b":"'affect':35B 'craft':30B 'crash':43B 'denial':47B 'effect':26B,31B 'effeks':16B,21B 'engin':19B 'file':27B,32B 'forc':38B 'game':18B 'game-engin':17B 'host':40B 'load':28B 'packag':20B 'process':41B 'proper':24B 'runtim':36B 'servic':49B 'valid':25B","search_c":"'affect':64C 'craft':57C 'crash':73C 'effect':53C,58C 'effeks':50C 'file':54C,59C 'forc':71C 'host':67C 'improp':51C 'load':61C 'may':69C 'process':68C 'runtim':65C 'valid':52C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T08:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120386","severity":null,"published_at":"2026-11-09T08:17:02+00:00","modified_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","fetched_at":"2026-11-09T08:25:21+00:00","note":null}],"documents":[{"id":106494,"url":"https://github.com/effekseer/Effekseer/commit/6cf1cb853383765153219ba5ce9b47eff5ad8398","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":106495,"url":"https://github.com/effekseer/Effekseer/releases/tag/1808","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}