Every CVE Search/ Get API key

CVE-2026-111270

libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM

6.9 Medium

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.20%Up 0.1 points since Oct 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Record
CVE-2026-111270
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-102525 6.9

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Record
EUVD-2026-102525
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-rxvf-jg5h-5fv5 6.9

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in...

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Record
GHSA-rxvf-jg5h-5fv5
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 6.9

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Record
CVE-2026-111270
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-111270 6.9

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Record
DEBIAN-CVE-2026-111270
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-111270 6.9

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Record
UBUNTU-CVE-2026-111270
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVAZL-110351 No score

CVE-2026-111270 affecting package libmodplug 0.8.9.0-12

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

Record
AZL-110351
Updated
2026-11-05
OSVopenSUSE-SU-2026:12215-1 No score

libmodplug-devel-0.8.9.0+git20170610.f6dd59a-4.1 on GA media

These are all security issues fixed in the libmodplug-devel-0.8.9.0+git20170610.f6dd59a-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12215-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22165-1 No score

Security update for libmodplug

This update for libmodplug fixes the following issues:

Changes in libmodplug:

  • CVE-2026-108577: This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption [bsc#1284977]
  • CVE-2026-111270: a heap-based out-of-bounds write in CSoundFile:ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS [bsc#1285765]
  • CVE-2026-111271: a heap-based out-of-bounds read vulnerability in CSoundFile:ReadAMS2() in src/load_ams.cpp [bsc#1285766]
  • CVE-2026-75904: libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp [bsc#1275624]
Record
openSUSE-SU-2026:22165-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmodplug
Azure Linux:3
 through 0.8.9.0-12 None known
libmodplug
Debian:12
 All versions, plus listed versions
1:0.8.9.0-31:0.8.9.0-4
 None known
libmodplug
Debian:13
 All versions, plus listed versions
1:0.8.9.0-31:0.8.9.0-4
 None known
libmodplug
Debian:14
 All versions, plus listed versions
1:0.8.9.0-31:0.8.9.0-4
 None known
gst-plugins-bad0.10
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.10.23-7ubuntu20.10.23-7.2ubuntu10.10.23-7.2ubuntu1.10.10.23-7.2ubuntu1.20.10.23-7.2ubuntu1.30.10.23-7.2ubuntu1.3+esm1
 None known
libmodplug
Ubuntu:14.04:LTS
 All versions, plus listed versions
1:0.8.8.4-41:0.8.8.4-4.1
 None known
libmodplug
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:0.8.8.5-2
 None known
libmodplug
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:0.8.9.0-1
 None known
libmodplug
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:0.8.9.0-21:0.8.9.0-2build1
 None known
libmodplug
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:0.8.9.0-3
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
libmodplug
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:0.8.9.0-31:0.8.9.0-3build1
 None known
libmodplug
Ubuntu:26.10
 All versions, plus listed versions
1:0.8.9.0-3build2
 None known
libmodplug
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:0.8.9.0-3build11:0.8.9.0-3build2
 None known
libmodplug
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.8.9.0+git20170610.f6dd59a-4.1
0.8.9.0+git20170610.f6dd59a-4.1
libmodplug
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 0.8.9.0+git20170610.f6dd59a-bp160.2.1
0.8.9.0+git20170610.f6dd59a-bp160.2.1

History

History
RecordedChangedSources
affected, facts
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-111270 is a medium vulnerability (CVSS 6.9) in Konstanty Bialkowski Libmodplug, published October 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. No source names a fixed version.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open