CVE-2026-105838: libmikmod before 3.3.14 Heap Out-of-Bounds Read via IT Module Loader
libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader loadit.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing ITConvertTrack() to read past the itpat buffer and crash applications.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An attacker must cause an application using libmikmod to load a crafted Impulse Tracker (IT) module. The malicious module uses more than 200 pattern rows, leading IT_ConvertTrack() to read beyond the itpat heap buffer.
What is the practical impact on affected applications?
The documented result is a heap out-of-bounds read that can crash the application, producing a denial of service. The provided data does not establish confidentiality or integrity impact beyond the adjacent-memory read.
Which versions should be remediated?
libmikmod versions before 3.3.14 are affected. Update to libmikmod 3.3.14 or later.
What can be done if an update cannot be applied immediately?
Do not load untrusted IT modules, particularly modules that may contain oversized patterns with more than 200 rows. Restricting ingestion of attacker-supplied music files reduces exposure until an update is available.