libxmp Off-by-One Stack Out-of-Bounds Read in P61A Depacker

Executive Summary

CVE-2026-111131 is an off-by-one stack out-of-bounds read vulnerability in libxmp through version 4.7.4. It occurs in the P61A depacker function (depack_p61a) when processing crafted headerless P61A modules with 31 samples and a specific 0xffe0 back-reference size word. This causes the function to read one element past the end of three 31-element stack arrays, leaking stack memory into sample metadata or disrupting module loading.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking for libxmp versions up to 4.7.4 and analyzing module files for crafted P61A formats. Use commands like 'xmp -v' to check libxmp version and inspect module files with hex editors for 31 samples and 0xffe0 back-reference size words.

Useful 0 Not Useful 0

Impact Analysis

The impact is limited to a stack out-of-bounds read during module loading. It may cause crashes, memory corruption, or unintended behavior in applications using libxmp to parse P61A module files. No confirmed out-of-bounds write, memory corruption, or information leak has been established.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a stack out-of-bounds read in a media library (libxmp) during module file processing. It may indirectly impact systems processing audio files if exploited, but no evidence suggests it leads to data breaches or unauthorized access to sensitive information covered by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libxmp to the latest patched version. If updating is not possible, avoid processing untrusted P61A module files until a fix is applied. Monitor vendor advisories for updates.

Useful 0 Not Useful 0