CVE-2026-75904: Out-of-bounds Read in Konstanty Bialkowski libmodplug
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
AI Analysis
Technical Summary
CVE-2026-75904 is an out-of-bounds read vulnerability in libmodplug versions up to 0.8.9.1. The issue occurs in the pat_smplooped function where the sample index is validated only against the upper bound MAXSMP, but then decremented by one before accessing the 191-byte static array pat_loops. If the index is zero, this results in reading pat_loops[-1], one byte before the array boundary. The index is taken from the smpno field of a parsed MIDI event, which is initialized to zero and only later updated from a program-change parameter. A crafted 32-byte MIDI file can trigger this condition through the ModPlug_Load entry point, affecting playback state by influencing whether a note event is treated as looping.
Potential Impact
The vulnerability allows an out-of-bounds read of one byte before a static array, which can influence playback state by affecting note event looping behavior. The CVSS score is 4.8 (medium severity), indicating limited impact without evidence of code execution or denial of service. There are no known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates. Until a patch is available, cautious handling of untrusted MIDI files is advised.
CVE-2026-75904: Out-of-bounds Read in Konstanty Bialkowski libmodplug
Description
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
CVSS v4.0
Score 4.8medium
Affected software
Konstanty Bialkowski
libmodplug
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75904 is an out-of-bounds read vulnerability in libmodplug versions up to 0.8.9.1. The issue occurs in the pat_smplooped function where the sample index is validated only against the upper bound MAXSMP, but then decremented by one before accessing the 191-byte static array pat_loops. If the index is zero, this results in reading pat_loops[-1], one byte before the array boundary. The index is taken from the smpno field of a parsed MIDI event, which is initialized to zero and only later updated from a program-change parameter. A crafted 32-byte MIDI file can trigger this condition through the ModPlug_Load entry point, affecting playback state by influencing whether a note event is treated as looping.
Potential Impact
The vulnerability allows an out-of-bounds read of one byte before a static array, which can influence playback state by affecting note event looping behavior. The CVSS score is 4.8 (medium severity), indicating limited impact without evidence of code execution or denial of service. There are no known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates. Until a patch is available, cautious handling of untrusted MIDI files is advised.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T14:53:24.138Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a847b9ec6e8be03326654c7
Added to database: 08/18/2026, 15:34:54 UTC
Last enriched: 09/25/2026, 02:41:34 UTC
Last updated: 10/02/2026, 02:46:06 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.