libmodplug versions up to 0.8.9.1 contain an out-of-bounds read in the pat_smplooped function within src/load_pat.cpp. The function checks only the upper bound of a sample index against MAXSMP but then subtracts one before indexing a 191-byte static array pat_loops. If the index is zero, the code reads pat_loops[-1], accessing memory before the array. This index comes from the smpno field of a parsed MIDI event, which is initialized to zero and only later overwritten. A specially crafted 32-byte MIDI file passed to the ModPlug_Load entry point can cause this out-of-bounds read during the processing of MIDI patterns, influencing playback state by determining whether a note event is treated as looping.

The out-of-bounds read may lead to reading memory adjacent to the pat_loops array, potentially causing incorrect playback behavior by influencing note looping state. The CVSS score of 4.8 (medium severity) reflects limited impact, with no known privilege escalation or code execution. There are no known exploits in the wild. The vulnerability requires local access and user interaction (loading a crafted MIDI file).

No official patch or remediation level is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid processing untrusted or crafted MIDI files with libmodplug versions up to 0.8.9.1.