CVE-2026-110876: AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files

Q: What must an attacker provide to trigger the issue?

The attacker must persuade a user or application to play a crafted XSM file. The file needs the ofTAZ! signature and a song byte of 0x80 or higher, which produces a negative note index during playback.

Q: Who is exposed in practice?

Applications that use AdPlug through version 2.4 and play untrusted or attacker-supplied XSM files are exposed. The vulnerability has a local attack vector and requires user interaction, consistent with opening or playing the crafted file.

Q: What is the likely impact of successful exploitation?

The out-of-bounds read occurs before the global note_table buffer and may cause the affected application to crash during playback. The provided impact information indicates availability impact only, with no stated confidentiality or integrity impact.

Published Oct 15, 2026

Updated

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.

Affected Software

1 affected component

AdPlug AdPlug<=2.4

Event History

Oct 15, 2026

CVE Published

via MITRE·06:57 PM

Data Sourced

via MITRE·06:57 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the issue?

The attacker must persuade a user or application to play a crafted XSM file. The file needs the ofTAZ! signature and a song byte of 0x80 or higher, which produces a negative note index during playback.

Who is exposed in practice?

Applications that use AdPlug through version 2.4 and play untrusted or attacker-supplied XSM files are exposed. The vulnerability has a local attack vector and requires user interaction, consistent with opening or playing the crafted file.

What is the likely impact of successful exploitation?

The out-of-bounds read occurs before the global note_table buffer and may cause the affected application to crash during playback. The provided impact information indicates availability impact only, with no stated confidentiality or integrity impact.

CVE-2026-110876: AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the issue?

Who is exposed in practice?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the issue?

Who is exposed in practice?

What is the likely impact of successful exploitation?