XXE Vulnerability in Yamaha VOCALOID6 Editor

Yamaha VOCALOID6 Editor contains a vulnerability that improperly restricts XML external entity (XXE) references. An attacker can trigger this vulnerability by providing a specially crafted project file to a victim. When the editor parses the malicious project file, it may be forced to initiate unintended network communications. This behavior can lead to the exfiltration of sensitive information from the local device or cause a denial-of-service (DoS) condition. The issue is significant for users handling creative projects on workstations that may contain proprietary or sensitive data. Defenders should ensure users are aware of the risks associated with loading untrusted project files.

Impact

Successful exploitation of this XXE vulnerability can lead to unauthorized information disclosure, potentially exposing local files to an attacker-controlled endpoint. Furthermore, the application's ability to be forced into a DoS state impacts the availability of the production environment for users dependent on the editor. The CVSS base score of 7.1 underscores the risk posed by this vulnerability within environments where the editor is deployed.

Recommendation

• Monitor workstation software inventory to identify systems running Yamaha VOCALOID6 Editor.
• Advise users to avoid opening project files from untrusted or unverified sources.
• Check the official Yamaha support portal for security updates or patches addressing CVE-2026-104679.