Threats affecting pkg:github/adplug

CVE-2026-110876 is an out-of-bounds read vulnerability in AdPlug up to version 2.4. It occurs in the src/xsm.cpp file when a crafted XSM file with a negative note index and specific signature causes a global buffer overflow read during playback, potentially crashing affected applications.

CVE-2026-110875 is a heap-based buffer overflow vulnerability in AdPlug through version 2.4. The flaw exists in the CksmPlayer::update() function in src/ksm.cpp, where a fixed-size buffer databuf[2048] is overwritten without proper bounds checking. An attacker can exploit this by supplying a crafted .ksm module with notes that share a time slot, causing memory corruption and denial of service.