CVE-2026-111165
Deferred Deferred - Pending Action

Global Out-of-Bounds Read in libmikmod MultiTracker Loader

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111165
EUVD
EUVD-2026-102292

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sezero libmikmod 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libmikmod through 3.3.15 has an out-of-bounds read flaw in the MTM loader function MTM_Load(). The vulnerability occurs because the module channel count is not clamped to a safe value. Attackers can craft a .mtm file with a channel count over 32, causing the loader to read past a fixed-size array and corrupt track indices, leading to crashes.

Detection Guidance

To detect this vulnerability, inspect systems using libmikmod versions 3.3.15 or earlier. Check for applications processing .mtm files. Use static analysis tools to review load_mtm.c for improper channel count validation. Monitor for crashes when loading MTM files.

Impact Analysis

This vulnerability can cause applications using libmikmod to crash when processing malicious .mtm files. It may also allow limited memory corruption, potentially leading to denial-of-service or unexpected behavior in media players or audio applications that rely on libmikmod.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA if exploited in systems handling personal or health data. An out-of-bounds read may lead to crashes or memory corruption, which could disrupt data processing or expose sensitive information. However, the CVE does not explicitly link this issue to data breaches or compliance violations.

Mitigation Strategies

Upgrade libmikmod to a patched version beyond 3.3.15. If upgrading is not possible, disable MTM file support in applications using libmikmod. Avoid processing untrusted .mtm files until the issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111165. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart