Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by VulnCheck

CVE-2026-105837libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow

High 7.8

In plain English

A high-severity integer overflow in libmikmod from sezero. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 96.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libmikmodno fix listedDEBIAN-CVE-2026-105837
Debian:13libmikmodno fix listedDEBIAN-CVE-2026-105837
Debian:14libmikmod3.3.14-1DEBIAN-CVE-2026-105837
Ubuntu:22.04:LTSlibmikmodno fix listedUBUNTU-CVE-2026-105837
Ubuntu:24.04:LTSlibmikmodno fix listedUBUNTU-CVE-2026-105837
Ubuntu:26.04:LTSlibmikmodno fix listedUBUNTU-CVE-2026-105837
Ubuntu:26.10libmikmodno fix listedUBUNTU-CVE-2026-105837
Ubuntu:22.04:LTStimidityno fix listedUBUNTU-CVE-2026-105837
Ubuntu:24.04:LTStimidityno fix listedUBUNTU-CVE-2026-105837
Ubuntu:26.04:LTStimidityno fix listedUBUNTU-CVE-2026-105837
Ubuntu:26.10timidityno fix listedUBUNTU-CVE-2026-105837

Affected products (as reported)

VendorProductVersions
sezero libmikmod 0 – before 3.3.14

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References