{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ayamahavocaloid6_editor/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yamaha:vocaloid6_editor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-104679"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VOCALOID6 Editor"],"_cs_severities":["high"],"_cs_tags":["vulnerability","xxe","application-security"],"_cs_type":"advisory","_cs_vendors":["Yamaha"],"content_html":"\u003cp\u003eYamaha VOCALOID6 Editor contains a vulnerability that improperly restricts XML external entity (XXE) references. An attacker can trigger this vulnerability by providing a specially crafted project file to a victim. When the editor parses the malicious project file, it may be forced to initiate unintended network communications. This behavior can lead to the exfiltration of sensitive information from the local device or cause a denial-of-service (DoS) condition. The issue is significant for users handling creative projects on workstations that may contain proprietary or sensitive data. Defenders should ensure users are aware of the risks associated with loading untrusted project files.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this XXE vulnerability can lead to unauthorized information disclosure, potentially exposing local files to an attacker-controlled endpoint. Furthermore, the application's ability to be forced into a DoS state impacts the availability of the production environment for users dependent on the editor. The CVSS base score of 7.1 underscores the risk posed by this vulnerability within environments where the editor is deployed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor workstation software inventory to identify systems running Yamaha VOCALOID6 Editor.\u003c/li\u003e\n\u003cli\u003eAdvise users to avoid opening project files from untrusted or unverified sources.\u003c/li\u003e\n\u003cli\u003eCheck the official Yamaha support portal for security updates or patches addressing CVE-2026-104679.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T10:00:07Z","date_published":"2026-10-19T10:00:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-104679/","summary":"Yamaha VOCALOID6 Editor is vulnerable to XML External Entity (XXE) injection via specially crafted project files, enabling unauthorized sensitive information disclosure or denial-of-service.","title":"XXE Vulnerability in Yamaha VOCALOID6 Editor","url":"https://feed.craftedsignal.io/briefs/2026-10-104679/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:yamaha:vocaloid6_editor:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}