CVE-2026-110875: AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the flaw?
The attacker must supply a crafted .ksm module in which notes share a single time slot. Exploitation occurs when AdPlug processes that module.
What is the practical impact described for successful exploitation?
The out-of-bounds write corrupts heap memory in the player object and can cause denial of service. The provided information does not establish impacts beyond memory corruption and denial of service.
Which deployments should be prioritized for review?
Prioritize systems using AdPlug through version 2.4 that process .ksm modules from untrusted or externally supplied sources. The issue is in the KSM player update path.