CVE-2026-111270 Details
Description
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.
A heap-based out-of-bounds write vulnerability has been identified in libmodplug versions through 0.8.9.1. The issue arises in the 'CSoundFile::ReadDSM' function within 'src/load_dsm.cpp', where the 'nPat' variable is not properly validated against the maximum allowed patterns. This oversight allows attackers to craft DSM files containing over 240 PATT chunks or manipulate the PATT chunk length to exceed the buffer limits, leading to heap memory corruption and process crashes.
The vulnerability can be fixed by adding a check to ensure 'nPat' does not exceed 'MAX_PATTERNS' before writing to the 'Patterns' and 'PatternSize' arrays. Additionally, the DSM loader should be updated to use subtraction-based length checks that account for potential 32-bit integer wraps, preventing similar issues in the future.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libmodplug | <= 0.8.9.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |