CVE-2026-111270: libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the consuming process.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A consuming application must attempt to parse an attacker-controlled DSM file. The file must contain more than 240 PATT chunks or use a wrapping patt_len value.
Which deployments are exposed?
Applications using libmodplug through version 0.8.9.1 are exposed when they process untrusted DSM files. Exploitation requires local attack vector conditions and user interaction, according to the supplied severity vector.
What is the expected impact?
A crafted DSM file can cause heap memory corruption through an out-of-bounds write and crash the consuming process. The provided severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.