|
[Japanese]
|
JVNDB-2026-029751
|
Multiple vulnerabilities in Yamaha VOCALOID6 Editor
|
|
VOCALOID6 Editor provided by Yamaha Corporation contains multiple vulnerabilities listed below.- Use of hard-coded credentials (CWE-798) - CVE-2026-76131
- Missing authentication for critical function (CWE-306) - CVE-2026-76137
Zero reported these vulnerabilities to JPCERT/CC.
JPCERT/CC coordinated with the developer.
|
|
CVSS V3 Severity:
Base Metrics 5.3 (Medium) [Other]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
The above CVSS base scores have been assigned for CVE-2026-76131 |
CVSS v3 Severity
Base Metrics:3.3 (Low) [Other]- Access Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact(C): Low
- Integrity Impact(I): None
- Availability Impact(A): None
The above CVSS base scores have been assigned for CVE-2026-76137
|
|
|
Yamaha Corporation
- VOCALOID6 Editor versions 6.13.1 and earlier
|
|
|
- An attacker may impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers (CVE-2026-76131).
- Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe (CVE-2026-76137).
|
|
[Update the Software]
Update the software to the latest version according to the information provided by the developer.
|
|
Yamaha Corporation
|
|
- Missing Authentication for Critical Function(CWE-306) [Other]
- Use of Hard-coded Credentials(CWE-798) [Other]
|
|
- CVE-2026-76131
- CVE-2026-76137
|
|
- JVN : JVNVU#90210212
|
|
- [2026/08/24]
Web page was published
|
