Read the docs
TI-2026-68420 Aliases CVE-2026-105837GHSA-rr6f-2vgw-5v76

libmikmod Heap Buffer Overflow via DSM Loader Integer Overflow

Priority LOW 38CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

libmikmod before 3.3.14 contains an integer overflow in DSM_Load() in load_dsm.c (CWE-190). A DSM module whose numchn and numpat product wraps a 16-bit value can overwrite heap memory, causing crashes or potential code execution. The CVSS 4.0 base score is 8.5 (HIGH), and the vector requires local access with user interaction. CISA has not added the issue to KEV, and its SSVC rates exploitation as none and automatable as no.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00146 3rd percentileScored 2026-11-07
Fix Fixed libmikmod (sezero): 3.3.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sezerolibmikmodbefore 3.3.143.3.14Patch availableCNA
  • libmikmod Vendorsezero Affected before 3.3.14 Fixed in 3.3.14 Patch available CNA

Remediation

Upgrade libmikmod to version 3.3.14 or later, which fixes the issue. Red Hat lists one product as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA libmikmod (sezero) Fixed in 3.3.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    sezero libmikmod 3.3.14

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-68422 Integer overflow in libmikmod OKT loader allows heap buffer overflowPriority LOW 38
    • TI-2026-68421 Heap out-of-bounds read in libmikmod IT module loaderPriority LOW 29
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105837
  2. 2026-10-06 Alias added: GHSA-rr6f-2vgw-5v76
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-06 Priority changed: MEDIUM → LOW
  5. 2026-10-07 Affected versions changed · Red Hat
  6. 2026-10-07 CVSS score added · Red Hat

References

Patch 1

Other 3

  • TI-2026-74940 Out-of-bounds access in libTiMidity via crafted SoundFont files CVSS 4.0MEDIUM 6.9
  • TI-2026-74939 Out-of-bounds read in libTiMidity SoundFont loader CVSS 4.0MEDIUM 6.9
  • TI-2026-74938 Stack out-of-bounds write in libTiMidity SoundFont loader CVSS 4.0MEDIUM 6.9
  • TI-2026-74950 Heap out-of-bounds read in libmikmod IMF module loader CVSS 4.0MEDIUM 6.8
  • TI-2026-74949 Out-of-bounds read in libmikmod MTM loader via channel count CVSS 4.0MEDIUM 6.8
  • TI-2026-68422 Integer overflow in libmikmod OKT loader allows heap buffer overflow CVSS 4.0HIGH 8.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences