Vendor
Yamaha VOCALOID6 Editor is vulnerable to XML External Entity (XXE) injection via specially crafted project files, enabling unauthorized sensitive information disclosure or denial-of-service.