CVE-2026-110877: AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load
AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packedmodule and potentially crash the application.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the issue?
An attacker must cause AdPlug to open a truncated TwinTeam DMO file. A 12- or 13-byte file can pass dmo_unpacker::decrypt() and reach the vulnerable CdmoLoader::load() code through CAdPlug::factory.
What is the practical impact of successful exploitation?
The vulnerable loader reads beyond the packed_module heap allocation. The described outcome is a potential application crash; no confidentiality or integrity impact is specified.
Are users exposed without opening attacker-controlled content?
The issue requires user interaction because a malicious DMO file must be supplied and opened. The provided data does not establish exposure through any default configuration or automated processing path.