JVNVU#93520490
Improper restriction of XML external entity references in Yamaha VOCALOID6 Editor

Overview

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.

Products Affected

• VOCALOID6 Editor versions 6.13.2 and earlier

Description

VOCALOID6 Editor provided by Yamaha Corporation contains the following vulnerability.

• Improper Restriction of XML External Entity Reference (CWE-611)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N Base Score 6.9
  • CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H Base Score 7.1
  • CVE-2026-104679

Impact

By loading a specially crafted project file, the product may initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.