TI-2026-70565 Aliases CVE-2026-108577 GHSA-252h-2265-gp6c

Resource consumption in libmodplug ABC Music Format parser

LOW 24CWE-400Published 2026-10-11 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Konstanty Bialkowski libmodplug up to 0.8.9.1 is affected. Processing crafted input in the abc_add_gchord function of the ABC Music Format parser causes resource consumption (CWE-400). A remote attacker can trigger it when a user processes crafted ABC music input.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00289 21st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Konstanty Bialkowski	libmodplug	0.8.9.0; 0.8.9.1	—	No fix listed	CNA

libmodplug VendorKonstanty Bialkowski Affected 0.8.9.0; 0.8.9.1 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:konstanty_bialkowski:libmodplug::::::::	—	—	Konstanty Bialkowski

cpe:2.3:a:konstanty_bialkowski:libmodplug:*:*:*:*:*:*:*:* Versions — — ·Konstanty Bialkowski

Remediation

The sources list no fixed version for libmodplug.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-11 Threatist record created from CVE-2026-108577
2026-10-11 Alias added: GHSA-252h-2265-gp6c
2026-10-13 Affected versions changed · Red Hat
2026-10-13 CVSS score added · Red Hat
2026-10-15 CISA SSVC decision points changed

References

—

TI-2026-75052 libmodplug Heap Out-of-Bounds Write via CSoundFile::ReadDSM CVSS 4.0MEDIUM 6.9
TI-2026-75053 Heap out-of-bounds read in libmodplug AMS file parsing CVSS 4.0MEDIUM 6.8
TI-2011-01393 Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before… CVSS 2.0MEDIUM 6.8
TI-2026-53134 libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File CVSS 4.0MEDIUM 4.8
TI-2011-01540 Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro… CVSS 2.0MEDIUM 6.8
TI-2009-01362 Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug… CVSS 2.0HIGH 7.5

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences