Threat database

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.

CVE-2026-111270 is a medium severity heap-based out-of-bounds write vulnerability in libmodplug up to version 0.8.9.1. It occurs in the CSoundFile::ReadDSM() function due to lack of bounds checking on the nPat variable against MAX_PATTERNS. An attacker can craft a malicious DSM file with excessive pattern chunks or manipulated length values to corrupt heap memory and cause a crash.

CVE-2026-108577 is a medium severity vulnerability in Konstanty Bialkowski's libmodplug library versions 0.8.9.0 and 0.8.9.1. It affects the ABC Music Format Parser component, specifically the abc_add_gchord function in src/load_abc.cpp. The vulnerability allows remote attackers to cause resource consumption, potentially leading to denial of service conditions. No vendor response or patch is currently available.

CVE-2026-75904 is an out-of-bounds read vulnerability in libmodplug up to version 0.8.9.1. The flaw occurs in the pat_smplooped function in src/load_pat.cpp, where an index derived from a MIDI event's smpno field can be zero, causing an out-of-bounds read one byte before a static array. This affects how note events are processed during playback.