CVE-2026-75904
Received Received - Intake

Out-of-Bounds Read in libmodplug MIDI Parser

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-75904
EUVD
EUVD-2026-60967

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
konstanty libmodplug 0.8.9.1
konstanty libmodplug to 0.8.9.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in the libmodplug library's pat_smplooped function. The function checks only the upper bound of its sample index and subtracts one before accessing a 191-byte array. When the index is zero, it reads one byte before the array, causing undefined behavior. The index comes from parsed MIDI event data that is initially zero and only updated later, allowing a crafted 32-byte MIDI file to trigger the issue.

Detection Guidance

To detect this vulnerability, check if your system uses libmodplug version 0.8.9.1 or earlier. Inspect installed packages for libmodplug and verify the version. Test with a crafted 32-byte MIDI file to see if it triggers crashes or unexpected behavior in applications using the library.

Impact Analysis

The vulnerability can cause crashes in hardened builds of applications using libmodplug. It may also influence audio playback state since the out-of-bounds byte affects whether a note event is treated as looping. Since libmodplug is used in media players and game engines, untrusted MIDI files could lead to denial-of-service or unexpected behavior.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-severity out-of-bounds read issue in a media library that could cause crashes or influence audio playback state when processing crafted MIDI files. No evidence suggests it impacts data confidentiality, integrity, or availability in a way that would violate regulatory requirements.

Mitigation Strategies

Immediately update libmodplug to a patched version that includes bounds checking for the sample index. If updating is not possible, restrict access to applications using libmodplug to untrusted files, especially MIDI files. Monitor for crashes or unusual playback behavior as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart