Heap Out-of-Bounds Write in Schism Tracker

Executive Summary

This is a heap out-of-bounds write vulnerability in Schism Tracker through version 20260524. The issue occurs in the fmt_ult_load_song() function in fmt/ult.c where a one-byte sample count from a .ult module file is not properly checked against the maximum allowed sample count (MAX_SAMPLES = 236). Attackers can craft a malicious .ult file that overwrites the instruments pointer array in memory. When the application later tries to free these corrupted pointers via csf_destroy(), it may free attacker-chosen memory locations, causing crashes or potential further exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to Schism Tracker's handling of .ult module files. To detect it, monitor for crashes when opening .ult files in Schism Tracker versions before 20260524. Check if Schism Tracker is installed and inspect loaded .ult files for suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

If you open a specially crafted .ult module file in Schism Tracker, the application may crash or execute arbitrary code. This could allow attackers to gain control over your system if they can trick you into opening a malicious file. The vulnerability requires no authentication or special options to trigger, making it dangerous for users who frequently load module files from untrusted sources.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a memory safety issue in Schism Tracker's UltraTracker module loader that could lead to crashes or potential arbitrary code execution when opening crafted files. Compliance impacts would only occur if such an exploit resulted in unauthorized data access or processing, which is not described in the provided context.

Useful 0 Not Useful 0

Mitigation Strategies

• Update Schism Tracker to the latest version beyond 20260524 to patch the vulnerability.
• Avoid opening untrusted .ult module files in Schism Tracker until patched.
• Monitor system logs for crashes or unusual behavior when using Schism Tracker.

Useful 0 Not Useful 0