CVE-2026-104679

CVSS 7.1 (high) · published 2026-10-19

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

Weakness: CWE-611

Source: NVD CVE-2026-104679

References

• https://jvn.jp/en/vu/JVNVU93520490/
• https://www.vocaloid.com/en/news/support_64/
• https://www.vocaloid.com/news/support_64/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.