CVE-2026-105837: libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow
libmikmod before 3.3.14 contains an integer overflow vulnerability in DSMLoad() in loaddsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
libmikmod versions before 3.3.14 are affected. Version 3.3.14 is identified as containing the fix.
What must an attacker do to exploit this issue?
An attacker must provide a crafted DSM module with track-count values that cause the numchn and numpat product to wrap a 16-bit value when DSM_Load() processes it. The supplied severity vector indicates that user interaction is required.
How can I determine whether my environment is exposed?
Check the installed libmikmod version and whether the application processes DSM modules through libmikmod. Versions earlier than 3.3.14 that load attacker-controlled or untrusted DSM files are exposed to the vulnerable parsing path.