Read the docs
TI-2026-74949 Aliases CVE-2026-111165

Out-of-bounds read in libmikmod MTM loader via channel count

Priority MEDIUM 63CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

libmikmod through 3.3.15 does not clamp the channel count in the MultiTracker loader MTM_Load(), which causes an out-of-bounds read (CWE-125). A local attacker supplies a crafted .mtm file with a channel count above 32, which makes the loader read past the static pat array. The read corrupts track indices and crashes the loading application.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sezerolibmikmodup to 3.3.15—No fix listedCNA
  • libmikmod Vendorsezero Affected up to 3.3.15 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libmikmod.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111165
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat
  5. 2026-10-21 CISA SSVC decision points changed
  6. 2026-10-21 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-74940 Out-of-bounds access in libTiMidity via crafted SoundFont files CVSS 4.0MEDIUM 6.9
  • TI-2026-74939 Out-of-bounds read in libTiMidity SoundFont loader CVSS 4.0MEDIUM 6.9
  • TI-2026-74938 Stack out-of-bounds write in libTiMidity SoundFont loader CVSS 4.0MEDIUM 6.9
  • TI-2026-74950 Heap out-of-bounds read in libmikmod IMF module loader CVSS 4.0MEDIUM 6.8
  • TI-2026-68422 Integer overflow in libmikmod OKT loader allows heap buffer overflow CVSS 4.0HIGH 8.5
  • TI-2026-68420 libmikmod Heap Buffer Overflow via DSM Loader Integer Overflow CVSS 4.0HIGH 8.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences