Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck
CVE-2026-75904libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File
Low 3.3
In plain English
A low-severity out-of-bounds read in libmodplug from Konstanty Bialkowski. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libmodplug | no fix listed | DEBIAN-CVE-2026-75904 |
| Debian:13 | libmodplug | no fix listed | DEBIAN-CVE-2026-75904 |
| Debian:14 | libmodplug | 1:0.8.9.0-4 | DEBIAN-CVE-2026-75904 |
| Ubuntu:22.04:LTS | libmodplug | no fix listed | UBUNTU-CVE-2026-75904 |
| Ubuntu:24.04:LTS | libmodplug | no fix listed | UBUNTU-CVE-2026-75904 |
| Ubuntu:26.04:LTS | libmodplug | no fix listed | UBUNTU-CVE-2026-75904 |
| Ubuntu:26.10 | libmodplug | no fix listed | UBUNTU-CVE-2026-75904 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Konstanty Bialkowski | libmodplug | 0 – through 0.8.9.1 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References
- https://github.com/Konstanty/libmodplug/issues/103 issue-tracking
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_pat.cpp#L213-L217 technical-description
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_mid.cpp#L829 technical-description
- https://github.com/Konstanty/libmodplug product
- VulnCheck Advisory: libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File third-party-advisory