Read the docs
TI-2026-68421 Aliases CVE-2026-105838GHSA-xrff-r355-6xmr

Heap out-of-bounds read in libmikmod IT module loader

Priority LOW 29CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

libmikmod before 3.3.14 contains a heap out-of-bounds read in the Impulse Tracker loader load_it.c, tracked as CWE-125. An attacker can supply a crafted IT module with more than 200 pattern rows, which causes IT_ConvertTrack() to read past the itpat buffer and crash applications. Exploiting it requires a user to open a crafted module, and the impact is limited to availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00128 2nd percentileScored 2026-11-07
Fix Fixed libmikmod (sezero): 3.3.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sezerolibmikmodbefore 3.3.143.3.14Patch availableCNA
  • libmikmod Vendorsezero Affected before 3.3.14 Fixed in 3.3.14 Patch available CNA

Remediation

Upgrade sezero libmikmod to version 3.3.14 or later, which fixes the flaw. Red Hat lists one product as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA libmikmod (sezero) Fixed in 3.3.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    sezero libmikmod 3.3.14

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-68422 Integer overflow in libmikmod OKT loader allows heap buffer overflowPriority LOW 38
    • TI-2026-68420 libmikmod Heap Buffer Overflow via DSM Loader Integer OverflowPriority LOW 38
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105838
  2. 2026-10-06 Alias added: GHSA-xrff-r355-6xmr
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-06 Priority changed: MEDIUM → LOW
  5. 2026-10-07 Affected versions changed · Red Hat
  6. 2026-10-07 CVSS score added · Red Hat

References

Patch 1

Other 3

  • TI-2026-74940 Out-of-bounds access in libTiMidity via crafted SoundFont files CVSS 4.0MEDIUM 6.9
  • TI-2026-74939 Out-of-bounds read in libTiMidity SoundFont loader CVSS 4.0MEDIUM 6.9
  • TI-2026-74938 Stack out-of-bounds write in libTiMidity SoundFont loader CVSS 4.0MEDIUM 6.9
  • TI-2026-74950 Heap out-of-bounds read in libmikmod IMF module loader CVSS 4.0MEDIUM 6.8
  • TI-2026-74949 Out-of-bounds read in libmikmod MTM loader via channel count CVSS 4.0MEDIUM 6.8
  • TI-2026-68422 Integer overflow in libmikmod OKT loader allows heap buffer overflow CVSS 4.0HIGH 8.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences