Threat database

libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file.

libmikmod versions up to 3.3.15 contain an out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() due to an unchecked channel count in crafted .mtm files. This can cause memory corruption and application crashes.

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.

libTiMidity version 0.2.8 contains a heap out-of-bounds read vulnerability in its SoundFont loader component. This flaw arises from unvalidated sampleId and instrument generator values used as table indices, which can be triggered by loading a crafted .sf2 file via the mid_set_soundfont() function. Exploitation can lead to application crashes due to reading memory beyond allocated heap boundaries.

CVE-2026-111154 is a stack out-of-bounds write vulnerability in libTiMidity version 0.2.8 within the SoundFont loader. It occurs due to unchecked generator operators in the parse_gen function, allowing crafted .sf2 files with out-of-range operator values to corrupt stack memory. This can cause crashes and memory corruption.

libmikmod versions before 3.3.14 contain an integer overflow vulnerability in the Oktalyzer loader function OKT_doPBOD(). This flaw allows attackers to craft OKT module files with manipulated track counts that cause a heap buffer overflow. The vulnerability arises from a 16-bit track count value (numtrk) wrapping due to an overflow in the SLEN chunk, leading to out-of-bounds writes. Exploitation can result in application crashes or potential code execution.

libmikmod versions before 3.3.14 contain a heap out-of-bounds read vulnerability in the Impulse Tracker loader component. This flaw allows attackers to craft IT module files with more than 200 pattern rows, causing the function IT_ConvertTrack() to read beyond the allocated itpat buffer and potentially crash applications.

libmikmod versions before 3.3.14 contain an integer overflow vulnerability in the DSM_Load() function. This flaw allows attackers to craft DSM modules with manipulated track counts that cause a 16-bit integer wraparound, leading to a heap buffer overflow. Exploitation can result in application crashes or potentially arbitrary code execution.