[Japanese]

JVNDB-2026-038886

Improper restriction of XML external entity references in Yamaha VOCALOID6 Editor

Overview

VOCALOID6 Editor provided by Yamaha Corporation contains the following vulnerability.
  • Improper Restriction of XML External Entity Reference (CWE-611) - CVE-2026-104679
Zero (wasthatzero.net) reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.1 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: High
Affected Products


Yamaha Corporation
  • VOCALOID6 Editor versions 6.13.2 and earlier

Impact

By loading a specially crafted project file, the product may initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.
Solution

[Update the Software]
Update the software to the latest version according to the information provided by the developer.
Vendor Information

Yamaha Corporation
CWE (What is CWE?)

  1. Improper Restriction of XML External Entity Reference(CWE-611) [Other]
CVE (What is CVE?)

  1. CVE-2026-104679
References

  1. JVN : JVNVU#93520490
Revision History

  • [2026/10/20]
      Web page was published

Date Public2026/10/19
Date First Published2026/10/20
Date Last Updated2026/10/20