Every CVE Search/ Get API key

CVE-2010-2546

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might...

9.3 HighFix available

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.

Exploit likelihood

6.72%Down 4.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.

Record
CVE-2010-2546
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.

Record
CVE-2010-2546
Updated
2026-11-02
EUVDEUVD-2010-2550 No score

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.

Record
EUVD-2010-2550
Updated
2026-11-03
GitHub AdvisoriesGHSA-5mrv-fmm3-qm6f No score

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might...

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.

Record
GHSA-5mrv-fmm3-qm6f
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.

Record
CVE-2010-2546
Updated
2026-11-02
OSVDEBIAN-CVE-2010-2546 No score

Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.

Record
DEBIAN-CVE-2010-2546
Updated
2026-11-02
OSVopenSUSE-SU-2024:10305-1 No score

libmikmod-devel-3.3.7-1.7 on GA media

These are all security issues fixed in the libmikmod-devel-3.3.7-1.7 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10305-1
Updated
2026-11-02
OSVSUSE-SU-2018:1471-1 No score

Security update for libmikmod

This update for libmikmod fixes the following issues:

  • CVE-2010-2546: Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995. (bsc#625547).
Record
SUSE-SU-2018:1471-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmikmod
Debian:12
 before 3.1.11-6.3
3.1.11-6.3
libmikmod
Debian:13
 before 3.1.11-6.3
3.1.11-6.3
libmikmod
Debian:14
 before 3.1.11-6.3
3.1.11-6.3
libmikmod
Debian:5.0
From an advisory covering 3 CVEs
 before 3.1.11-6.0.1+lenny1, plus listed versions
3.1.11-63.1.11-6+lenny13.1.11-6.0.1
3.1.11-6.0.1+lenny1
libmikmod
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 2 CVEs
 before 3.1.11a-116.2.3.1
3.1.11a-116.2.3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-2546 is a high vulnerability (CVSS 9.3) in Raphael Assenat Libmikmod, published August 1, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.72%, the 93rd percentile. Fixed in libmikmod 3.1.11-6.3.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open