CVE-2018-20860
libopenmpt before 0.3.13 allows a crash with malformed MED files.
CVE-2018-20860 is a medium vulnerability (CVSS 6.5) in Openmpt Libopenmpt, published July 30, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in libopenmpt 0.3.13-1.
libopenmpt before 0.3.13 allows a crash with malformed MED files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
libopenmpt before 0.3.13 allows a crash with malformed MED files.
- Record
CVE-2018-20860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
libopenmpt before 0.3.13 allows a crash with malformed MED files.
- Record
CVE-2018-20860- Updated
- 2026-11-02
EUVDEUVD-2018-13398 No score
libopenmpt before 0.3.13 allows a crash with malformed MED files.
- Record
EUVD-2018-13398- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rhfq-j8mm-hh2p
libopenmpt before 0.3.13 allows a crash with malformed MED files.
libopenmpt before 0.3.13 allows a crash with malformed MED files.
- Record
GHSA-rhfq-j8mm-hh2p- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
libopenmpt before 0.3.13 allows a crash with malformed MED files.
- Record
CVE-2018-20860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-20860
libopenmpt before 0.3.13 allows a crash with malformed MED files.
- Record
DEBIAN-CVE-2018-20860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2018-20860
libopenmpt before 0.3.13 allows a crash with malformed MED files.
- Record
UBUNTU-CVE-2018-20860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2212-1 No score
Security update for libopenmpt
This update for libopenmpt fixes the following issues:
Security issues fixed:
- CVE-2018-20861: Fixed crash with certain malformed custom tunings in MPTM files (bsc#1143578).
- CVE-2018-20860: Fixed crash with malformed MED files (bsc#1143581).
- CVE-2019-14383: Fixed J2B that allows an assertion failure during file parsing with debug STLs (bsc#1143584).
- CVE-2019-14382: Fixed DSM that allows an assertion failure during file parsing with debug STLs (bsc#1143582).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2212-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2213-1 No score
Security update for libopenmpt
This update for libopenmpt fixes the following issues:
Security issues fixed:
- CVE-2018-20861: Fixed crash with certain malformed custom tunings in MPTM files (bsc#1143578).
- CVE-2018-20860: Fixed crash with malformed MED files (bsc#1143581).
- CVE-2019-14383: Fixed J2B that allows an assertion failure during file parsing with debug STLs (bsc#1143584).
- CVE-2019-14382: Fixed DSM that allows an assertion failure during file parsing with debug STLs (bsc#1143582).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2213-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10965-1 No score
libopenmpt-devel-0.5.11-1.2 on GA media
These are all security issues fixed in the libopenmpt-devel-0.5.11-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10965-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2435-1 No score
Security update for libopenmpt
This update for libopenmpt fixes the following issues:
Security issues fixed:
- CVE-2018-20861: Fixed crash with certain malformed custom tunings in MPTM files (bsc#1143578).
- CVE-2018-20860: Fixed crash with malformed MED files (bsc#1143581).
- CVE-2019-14383: Fixed J2B that allows an assertion failure during file parsing with debug STLs (bsc#1143584).
- CVE-2019-14382: Fixed DSM that allows an assertion failure during file parsing with debug STLs (bsc#1143582).
- Record
SUSE-SU-2019:2435-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libopenmptDebian:12 |
before 0.3.13-1 | 0.3.13-1 |
libopenmptDebian:13 |
before 0.3.13-1 | 0.3.13-1 |
libopenmptDebian:14 |
before 0.3.13-1 | 0.3.13-1 |
libopenmptSUSE:Linux Enterprise Module for Desktop Applications 15 |
before 0.3.17-2.7.1 | 0.3.17-2.7.1 |
libopenmptSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 0.3.17-2.7.1 | 0.3.17-2.7.1 |
libopenmptUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.2.8760~beta27-10.3.1-10.3.2-10.3.3-10.3.4-10.3.6-10.3.6-1ubuntu0.1~esm10.3.6-1ubuntu0.1~esm2 |
None known |
libopenmptopenSUSE:Leap 15.0 |
before 0.3.17-lp150.7.1 | 0.3.17-lp150.7.1 |
libopenmptopenSUSE:Leap 15.1 |
before 0.3.17-lp151.2.3.1 | 0.3.17-lp151.2.3.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lib.openmpt.org/libopenmpt/2018/10/21/security-updates-0.3.13-0.2.10933-beta36-0.2.7561-beta20.5-p11-0.2.7386-beta20.3-p14
lists.opensuse.org/opensuse-security-announce/2019-09/msg00085.html
nvd.nist.gov/vuln/detail/CVE-2018-20860
github.com/advisories/GHSA-rhfq-j8mm-hh2p
security-tracker.debian.org/tracker/CVE-2018-20860
Show 18 moreShow less
suse.com/support/update/announcement/2019/suse-su-20192435-1
bugzilla.suse.com/1143578
ubuntu.com/security/CVE-2018-20860
source.openmpt.org/browse/openmpt/trunk?op=revision&rev=10903
cve.org/CVERecord?id=CVE-2018-20860