CVE-2026-111271: libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any application that uses an affected libmodplug version to parse AMS module files is exposed when it processes an attacker-supplied crafted AMS file. The described outcome is a crash of the libmodplug consumer.
What must an attacker do to trigger the vulnerability?
The attacker must provide a crafted AMS module with pattern effect bytes that keep bit 7 set. This causes CSoundFile::ReadAMS2() to advance past the input buffer.
Is user interaction required?
Yes. The supplied CVSS vector includes UI:R, indicating that a user must interact with attacker-controlled content, such as causing the consuming application to process the crafted AMS file.