CVE-2026-75904 PUBLISHED

libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File

Assigner: VulnCheck
Reserved: 18.08.2026 Published: 18.08.2026 Updated: 18.08.2026

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 4.8

Product Status

Vendor Konstanty Bialkowski
Product libmodplug
Versions Default: unaffected
  • affected from 0 to 0.8.9.1 (incl.)

Credits

  • Përparim Mjeku (perparimmjeku) reporter

References

Problem Types

  • Out-of-bounds Read CWE