Read the docs
TI-2026-75053 Aliases CVE-2026-111271

Heap out-of-bounds read in libmodplug AMS file parsing

Priority MEDIUM 63CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

libmodplug through 0.8.9.1 contains a heap out-of-bounds read (CWE-125) in CSoundFile::ReadAMS2(). A crafted AMS module whose pattern effect bytes keep bit 7 set lets an attacker read adjacent heap memory and crash any libmodplug consumer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Konstanty Bialkowskilibmodplugup to 0.8.9.1—No fix listedCNA

Remediation

The sources list no fixed version for libmodplug.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111271
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat

References

Other 3

  • TI-2026-75052 libmodplug Heap Out-of-Bounds Write via CSoundFile::ReadDSM CVSS 4.0MEDIUM 6.9
  • TI-2011-01393 Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before… CVSS 2.0MEDIUM 6.8
  • TI-2026-53134 libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File CVSS 4.0MEDIUM 4.8
  • TI-2011-01540 Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro… CVSS 2.0MEDIUM 6.8
  • TI-2009-01362 Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug… CVSS 2.0HIGH 7.5
  • TI-2013-03705 Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord… CVSS 2.0MEDIUM 6.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences