CVE-2026-111131 Details
Description
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or disrupt loading.
A stack out-of-bounds read vulnerability has been identified in libxmp versions through 4.7.4. The issue resides in the prowizard P61A depacker function 'depack_p61a', located in 'src/loaders/prowizard/p61a.c'. This vulnerability allows attackers to manipulate a crafted headerless P61A module containing 31 samples and a back-reference size word of 0xffe0. Such manipulation can lead to the leakage of stack memory into sample metadata or disrupt the loading process.
Users can upgrade to libxmp version 4.7.5, where this vulnerability has been fixed. The patch involves adjusting the back-reference validation to ensure it does not allow indices that could lead to an out-of-bounds read.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libxmp | <= 4.7.4 (semver) 5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |