Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75904— libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File

Quick assessment

Affected
Konstanty Bialkowski libmodplug
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

konstanty bialkowski libmodplug是konstanty bialkowski个人开发者开源的一个音频模块播放库。 konstanty bialkowski libmodplug 0.8.9.1及之前版本存在缓冲区错误漏洞，该漏洞源于src/load_pat.cpp中的pat_smplooped函数仅验证样本索引上限后减一，导致索引为零时读取静态数组前一个字节，可能影响播放状态。

CVSS 3.3 · Low EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
Konstanty Bialkowski libmodplug ≤ 0.8.9.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75904

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File
Source: CVE Program / CVE List V5
Vulnerability Description
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
konstanty bialkowski libmodplug 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
konstanty bialkowski libmodplug是konstanty bialkowski个人开发者开源的一个音频模块播放库。 konstanty bialkowski libmodplug 0.8.9.1及之前版本存在缓冲区错误漏洞，该漏洞源于src/load_pat.cpp中的pat_smplooped函数仅验证样本索引上限后减一，导致索引为零时读取静态数组前一个字节，可能影响播放状态。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Konstanty Bialkowski libmodplug 0 ~ 0.8.9.1 -

II. Public POCs for CVE-2026-75904

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75904

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75904 (2)

Other References for CVE-2026-75904 (1)

IV. Related Vulnerabilities

Same weakness: CWE-125

V. Comments for CVE-2026-75904

No comments yet

Leave a comment