CVE-2026-111165 Details

A global out-of-bounds read vulnerability has been identified in libmikmod versions through 3.3.15, specifically within the MultiTracker loader function MTM_Load(). The vulnerability arises because the module channel count is not properly validated, allowing attackers to craft .mtm files with channel counts exceeding 32. This oversight enables exploitation by reading past the bounds of a static array, leading to corruption of track indices and causing the application to crash during file loading.

To address this vulnerability, the channel count should be validated and clamped before use in the MTM loader. This can be done by rejecting any channel count above 32, which is the maximum allowed by the MTM format. Additionally, the Impulse Tracker loader's method of handling channel counts could be adopted as a model for this fix.