CVE-2026-111131: libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or disrupt loading.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker must cause libxmp to process a crafted headerless P61A module. The malicious module needs 31 samples and a 0xffe0 back-reference size word.
What is the potential impact of processing a malicious module?
The out-of-bounds stack read can leak stack memory into sample metadata or disrupt module loading. The provided vector indicates local access and user interaction are required, while no privileges are required.
Which libxmp versions are affected?
The issue is reported in libxmp through version 4.7.4. No fixed version is provided in the available data.