Heap-based Buffer Overflow in libmodplug

Executive Summary

This vulnerability is a heap-based out-of-bounds write in the libmodplug library version 0.8.9.1 or earlier. It occurs in the CSoundFile::ReadDSM() function when processing DSM files. The issue arises because the code does not validate the number of patterns (nPat) against the maximum allowed (MAX_PATTERNS). Attackers can exploit this by providing a malicious DSM file with over 240 PATT chunks or a manipulated patt_len value, leading to heap memory corruption and potential crashes in the affected application.

Useful 0 Not Useful 0

Impact Analysis

If you use software that relies on libmodplug to process DSM files, this vulnerability could allow attackers to execute arbitrary code, crash the application, or cause denial-of-service conditions. Since the exploit involves a crafted file, simply opening a malicious DSM file could trigger the issue. The impact depends on the privileges of the affected process and whether the library is used in a security-critical context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR or HIPAA if the affected software processes personal or health data. A successful exploit might lead to unauthorized data access, modification, or deletion, violating confidentiality and integrity requirements. Organizations must ensure vulnerable systems are patched to maintain compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update libmodplug to version 0.8.9.1 or later to address the heap-based out-of-bounds write in CSoundFile::ReadDSM(). Avoid processing untrusted DSM files until patched.

Useful 0 Not Useful 0