libmikmod CVE-2026-105837

Exploitation requires an application that uses libmikmod (before 3.3.14) to load and parse an attacker-controlled DSM-format module file; the crafted file must set the numchn and numpat header fields so that their product (numtrk) overflows the 16-bit UWORD truncation in DSM_Load() at load_dsm.c. LIMITING FACTORS: the attack vector is local/file-based (AV:L), not network-reachable, and requires passive user interaction (UI:P) - the victim must open or play the malicious module. No authentication or privileges are needed (PR:N), and default configurations are vulnerable since the missing bounds check is in the core loader. Risk is confined to contexts where libmikmod processes untrusted module files.

This is a genuine but conditional memory-corruption flaw, not a drive-by remote threat. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) is internally consistent with the description: exploitation is LOCAL because it requires parsing an attacker-supplied DSM module file, and it requires passive user interaction (UI:P) - the victim must open or play the malicious module in an application linked against libmikmod. PR:N confirms no authentication is needed. The high VC/VI/VA impact reflects the heap buffer overflow that the integer overflow (CWE-190, numchn*numpat wrapping a 16-bit value) enables, with potential for code execution in the context of the host application. The patch commit (a125eabb) independently confirms the root cause and fix: a bounds check rejecting numchn>DSM_MAXCHAN or numtrk>65535 before the UWORD truncation. KEV status is NO and no EPSS score is provided in the input, so there is no quantitative exploitation-probability signal; the 'RCE' tag reflects theoretical potential, not confirmed in-the-wild use. Net: a defensible 8.5 'High', but the local vector plus required user interaction and the lack of any active-exploitation or EPSS signal place this below internet-facing RCEs in priority. It matters most where libmikmod processes untrusted module files (media players, games, file converters).

An attacker crafts a malicious DSM module file whose numchn and numpat values multiply to overflow a 16-bit track count, then distributes it (email attachment, download, game mod). When a victim opens or plays the file in any application using libmikmod before 3.3.14, DSM_Load() truncates the wrapped count and writes past the allocated heap buffer, causing a crash or potential code execution in the application's context. No public exploit has been identified at time of analysis, though the vendor patch pinpoints the exact flaw.