CVE-2026-111165: libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count
libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An attacker must persuade a user or application to load a crafted .mtm module file. The file needs a channel count greater than 32, which causes MTM_Load() to read past the static pat array.
What is the practical impact on an affected application?
The out-of-bounds read corrupts track indices and can crash the application while it loads the malicious .mtm file. The supplied data does not indicate confidentiality or integrity impact.
Which deployments are exposed?
Applications using libmikmod through version 3.3.15 and loading untrusted or attacker-provided .mtm files are exposed. Exploitation is local and requires user interaction according to the provided vector.