CVE-2026-110875 Details

A heap-based buffer overflow vulnerability has been identified in AdPlug versions through 2.4, specifically within the KSM (Ken Silverman's Music) format player. The issue arises in the 'CksmPlayer::update()' function, located in 'src/ksm.cpp'. The vulnerability allows attackers to supply a crafted .ksm module that exploits the note scheduling to overwrite memory beyond the bounds of a fixed-size buffer, 'databuf', which is 2048 bytes. This unbounded write leads to memory corruption and a denial-of-service condition.

Users can update to the patched version of AdPlug, where this vulnerability has been addressed. The specific changes made include adding bounds checks to prevent the buffer overflow and correcting the frequency table indexing to avoid out-of-bounds reads.