CVE-2026-75904
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index and then subtracts one before indexing the pat_loops array, allowing a read of one byte before the array when the index is zero.
Risk Assessment
Out-of-bounds read may lead to unexpected MIDI playback behavior, and in extreme cases, data disclosure or application crash.
Recommendation
Update libmodplug to a patched version or avoid processing untrusted MIDI files.
Other vulnerabilities in libmodplug
See all- CVE-2026-111271Medium
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.
- CVE-2026-111270Medium
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.
- CVE-2026-108577Medium
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS