VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

VOCALOID6 Editor provided by Yamaha Corporation contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/611.html' target='_blank'></a><ul><li>Improper Restriction of XML External Entity Reference (CWE-611) - CVE-2026-104679</li></ul>Zero (wasthatzero.net) reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer.