Threat Intelligence Database

A resource consumption vulnerability exists in Konstanty Bialkowski libmodplug up to version 0.8.9.1, specifically in the abc_add_gchord function of the ABC Music Format Parser component. This vulnerability can be triggered remotely and may lead to denial of service conditions. The vendor has not responded to disclosure attempts, and no patch information is available. The CVSS score is 4.3, indicating a low severity impact focused on availability.

CVE-2026-108577 is a medium severity vulnerability in Konstanty Bialkowski's libmodplug library versions 0.8.9.0 and 0.8.9.1. It affects the ABC Music Format Parser component, specifically the abc_add_gchord function in src/load_abc.cpp. The flaw allows remote attackers to cause resource consumption, potentially impacting system availability. No vendor response or patch is currently available.

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.