libmikmod CVE-2026-105839

Requires the victim to load or process an attacker-supplied Oktalyzer (.okt) module file in an application linked against libmikmod before 3.3.14, specifically reaching the OKT loader's OKT_doPBOD() path. The malicious file must set SLEN/pattern/channel values such that numpat * numchn exceeds 65535 and wraps the 16-bit numtrk field. Limiting factors: exploitation is local (AV:L) and demands user interaction (UI:P) - there is no remote network trigger in a default configuration; impact is bounded to contexts that parse untrusted OKT modules (games, media players, converters using the libmikmod OKT loader). Fixed versions (3.3.14+) reject the overflowing track count outright.

This is a genuine but conditionally-gated memory-corruption flaw rather than a drop-everything remote threat. The CVSS 4.0 base of 8.5 (High) is driven by full VC:H/VI:H/VA:H triad impact combined with PR:N and AC:L, but two metrics meaningfully constrain real-world risk: AV:L (local - the malicious OKT module must be processed on the victim system, not delivered over a network) and UI:P (the victim must open or load the crafted file). The integer overflow (CWE-190) is confirmed by the vendor source: of.numtrk = of.numpat * of.numchn wraps the 16-bit value, and the 3.3.14 patch adds an explicit >65535 bounds check, so the root cause and fix are unambiguous. No EPSS score, KEV listing, or public POC was provided in the input; the only exploit-adjacent artifact is the patch commit diff, which is not weaponized proof-of-concept code. Signals are therefore consistent rather than conflicting: high technical impact, but a local-plus-user-interaction delivery path and no evidence of active exploitation point to opportunistic/targeted risk (e.g., malicious media files) rather than mass exploitation. Prioritize patching in software that auto-parses untrusted module files, but this is not an internet-facing wormable issue. EPSS is missing - exploitation probability cannot be quantified from the data given.

An attacker crafts a malicious Oktalyzer (.okt) module whose SLEN chunk forces numpat * numchn to overflow the 16-bit numtrk field, then distributes it as a music/game asset or tricks a user into opening it in an application built on libmikmod. When the OKT loader runs OKT_doPBOD(), PBOD data is written past the undersized track-pointer allocation, corrupting the heap for a crash or potential arbitrary code execution. No public exploit was identified in the provided data, though the vendor patch pinpoints the vulnerable multiplication.