JVNVU#90210212
Multiple vulnerabilities in Yamaha VOCALOID6 Editor

Overview

VOCALOID6 Editor provided by Yamaha Corporation contains multiple vulnerabilities.

Products Affected

• VOCALOID6 Editor versions 6.13.1 and earlier

Description

VOCALOID6 Editor provided by Yamaha Corporation contains multiple vulnerabilities listed below.

• Use of hard-coded credentials (CWE-798)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 6.9
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score 5.3
  • CVE-2026-76131
• Missing authentication for critical function (CWE-306)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 4.8
  • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score 3.3
  • CVE-2026-76137

Impact

• An attacker may impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers (CVE-2026-76131).
• Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe (CVE-2026-76137).

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.