CVE-2026-75904: libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File
libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlugLoad entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MIDReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications that pass untrusted MIDI files to libmodplug through its public ModPlug_Load entry point are exposed. Exploitation requires a user or application workflow that causes the library to parse a crafted MIDI file; no privileges are required, but user interaction is required by the supplied severity vector.
What does an attacker need to trigger the out-of-bounds read?
A crafted 32-byte MIDI file can reach the vulnerable path. The triggering condition is a MIDI note event processed before an instrument assignment, leaving the event's smpno value at its initialized value of zero.
What is the practical effect of a successful trigger?
The affected code path reads one byte before the static pat_loops array when smpno is zero. That adjacent byte influences whether the note is treated as looping, affecting playback state; the provided data describes an out-of-bounds read, not a write or code-execution impact.
What mitigation is available before patching?
If updates cannot be applied, avoid loading MIDI files from untrusted sources through ModPlug_Load. Restricting the library to trusted module inputs prevents the described crafted-MIDI trigger path.