TI-2026-75052 Aliases CVE-2026-111270 GHSA-rxvf-jg5h-5fv5

libmodplug Heap Out-of-Bounds Write via CSoundFile::ReadDSM

MEDIUM 64CWE-787Published 2026-10-15 · Updated 2026-10-21

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · Low · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp, because nPat is never checked against MAX_PATTERNS (CWE-787). An attacker can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process. CVSS 4.0 scores it 6.9 (MEDIUM) with local attack vector and user interaction required. CISA SSVC rates exploitation as PoC and not automatable.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00196 9th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Konstanty Bialkowski	libmodplug	up to 0.8.9.1	—	No fix listed	CNA

libmodplug VendorKonstanty Bialkowski Affected up to 0.8.9.1 Fixed in — No fix listed CNA

Remediation

No fix is listed for libmodplug, so affected versions through 0.8.9.1 remain vulnerable. Do not load DSM files from untrusted sources in applications that use libmodplug.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-16 Threatist record created from CVE-2026-111270
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-16 Affected versions changed · Red Hat
2026-10-16 CVSS score added · Red Hat
2026-10-21 Alias added: GHSA-rxvf-jg5h-5fv5
2026-10-21 CISA SSVC decision points changed
2026-10-21 Priority changed: LOW → MEDIUM

References

Other 3

TI-2026-75053 Heap out-of-bounds read in libmodplug AMS file parsing CVSS 4.0MEDIUM 6.8
TI-2011-01393 Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before… CVSS 2.0MEDIUM 6.8
TI-2026-53134 libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File CVSS 4.0MEDIUM 4.8
TI-2011-01540 Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro… CVSS 2.0MEDIUM 6.8
TI-2009-01362 Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug… CVSS 2.0HIGH 7.5
TI-2013-03705 Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord… CVSS 2.0MEDIUM 6.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences