CVE-2026-110877

Deferred Deferred - Pending Action

Heap Out-of-Bounds Read in AdPlug

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110877

EUVD

EUVD-2026-102352

Affected Vendors & Products

Vendor	Product	Version / Range
adplug	adplug	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a heap out-of-bounds read vulnerability in AdPlug version 2.4 and earlier. It occurs in the CdmoLoader::load() function when processing a maliciously crafted TwinTeam DMO file. Attackers can supply a 12- or 13-byte file that bypasses decryption checks, causing the application to read memory beyond allocated heap space. This may lead to information disclosure or application crashes.

Detection Guidance

Detecting this vulnerability requires analyzing AdPlug's handling of DMO files. Check for crashes or memory corruption when processing DMO files with tools like Valgrind or AddressSanitizer. Monitor logs for heap out-of-bounds read errors during file parsing. Inspect files smaller than 14 bytes passed to AdPlug's factory functions.

Impact Analysis

An attacker could exploit this to read sensitive memory contents, potentially exposing confidential data. It may also cause the application to crash, leading to denial of service. The impact depends on the application's context and how AdPlug is used within it.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It is a heap out-of-bounds read issue in AdPlug that could lead to information disclosure or application crashes. Compliance risks would only arise if the vulnerability were exploited to access or expose sensitive data, which is not explicitly described in the provided context.

Mitigation Strategies

Immediately update AdPlug to the latest version beyond 2.4. If updating is not possible, disable DMO file support in AdPlug's configuration. Avoid opening untrusted DMO files. Implement file size validation before processing to ensure files are at least 14 bytes.

Hi! I’m here to help you understand CVE-2026-110877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70