CVE-2026-111166: Out-of-bounds Read in sezero libmikmod

The vulnerability in libmikmod (up to version 3.3.15) involves a heap out-of-bounds read in the IMF_Load() function. By supplying a specially crafted IMF module with the linear-period header flag enabled and notes mapped to out-of-range samples, an attacker can cause the noteindex to read memory beyond the allocated heap. This can lead to application crashes when loading the crafted file. The CVSS 4.0 base score is 6.8, indicating a medium severity with local attack vector, low complexity, no privileges required, and user interaction needed.

An attacker can cause applications using vulnerable versions of libmikmod to crash by loading a maliciously crafted IMF module. This results in a denial of service due to heap out-of-bounds reads. There is no indication of code execution or data disclosure beyond the out-of-bounds read and crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid loading untrusted IMF module files with libmikmod versions up to 3.3.15.