CVE-2026-104679

7.1High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.1High

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on confidentiality, availability
Weakness: CWE-611

Impact

Attackers can exfiltrate local files or trigger a denial of service on the user's machine. They need the local user to open a specially crafted project file in the editor.

Root cause

Improper restriction of XML external entity (XXE) references when parsing project files.

Affected systems

Yamaha VOCALOID6 Editor (specific affected versions not listed — check the vendor advisory).

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Fix & remediation

Upgrade VOCALOID6 Editor to the patched release referenced in Yamaha advisory support_64; do not open untrusted project files until updated.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-104679