CVE-2026-111271

Received Received - Intake

Heap-based Out-of-Bounds Read in libmodplug

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111271

Affected Vendors & Products

Vendor	Product	Version / Range
Konstanty	Bialkowski	libmodplug 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

libmodplug through 0.8.9.1 has a heap-based out-of-bounds read flaw in the CSoundFile::ReadAMS2() function. This occurs when processing crafted AMS files where pattern effect bytes have bit 7 set, causing the decoder to read past the input buffer into adjacent heap memory. This can lead to crashes in any application using libmodplug.

Detection Guidance

This vulnerability involves a heap-based out-of-bounds read in libmodplug when processing crafted AMS files. Detection requires checking for vulnerable versions of libmodplug and scanning for suspicious AMS files. Use commands like 'find / -name "*.ams" 2>/dev/null' to locate AMS files and 'ldd /path/to/binary | grep libmodplug' to check for linked vulnerable libraries.

Impact Analysis

If you use software that relies on libmodplug to process AMS music files, an attacker could exploit this flaw by providing a maliciously crafted file. This may cause the application to crash or potentially expose sensitive memory contents. Users should update to a patched version of libmodplug.

Mitigation Strategies

Immediately update libmodplug to version 0.8.9.2 or later. Remove or restrict access to untrusted AMS files. Monitor systems for crashes or memory corruption when processing media files. Disable applications using libmodplug if patches are unavailable.

Hi! I’m here to help you understand CVE-2026-111271. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70