libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Konstanty Bialkowski | libmodplug | up to 0.8.9.1 | — | No fix listed | CNA |
- libmodplug VendorKonstanty Bialkowski Affected up to 0.8.9.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-75904
- 2026-10-03 Alias added: GHSA-prc8-cg98-hxwc
References
Other 4
- https://github.com/Konstanty/libmodplug/issues/103
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_pat.cpp#L213-L217
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_mid.cpp#L829
- https://github.com/Konstanty/libmodplug
More Konstanty Bialkowski vulnerabilities
- TI-2026-75052 libmodplug Heap Out-of-Bounds Write via CSoundFile::ReadDSM CVSS 4.0MEDIUM 6.9
- TI-2026-75053 Heap out-of-bounds read in libmodplug AMS file parsing CVSS 4.0MEDIUM 6.8
- TI-2011-01393 Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before… CVSS 2.0MEDIUM 6.8
- TI-2011-01540 Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro… CVSS 2.0MEDIUM 6.8
- TI-2009-01362 Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug… CVSS 2.0HIGH 7.5
- TI-2013-03705 Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2026-75904 · CVE Program
- CVE-2026-75904 · NVD
- FIRST EPSS
- GHSA-prc8-cg98-hxwc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-75904 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences