EUVD-2026-102350
GHSA-jrh8-g7qr-96vg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted .ksm module to victim
-
ExploitVictim opens file in AdPlug ≤2.4
-
ExecutionCksmPlayer::update() writes past databuf[2048]
-
ImpactHeap corruption and crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open or play an attacker-supplied crafted .ksm (Ken Silverman KSM) module file in an application that uses AdPlug ≤2.4; the malicious file must contain notes arranged to share a single time slot so the per-slot write count exceeds the fixed databuf[2048] buffer. No special configuration is needed - default handling of .ksm files is vulnerable. Exploitation is LIMITED by its local attack vector (the file must reach and be processed on the target) and by required user interaction (passive: opening/playing the file); it is not remotely or network-triggerable without that action, which substantially reduces real-world risk despite the unauthenticated nature of the parsing code. |
| Impact | This is a genuine but modest-severity memory-safety flaw, not a high-urgency priority. The authoritative signal is the vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H), yielding 6.9 (Medium): exploitation is local and requires the victim to open/play a crafted .ksm file (passive user interaction), with impact dominated by availability (VA:H) and only low integrity (VI:L), no confidentiality impact. CWE-787 (out-of-bounds write) technically carries code-execution potential, but the reporter (VulnCheck) and description scope the realistic outcome to memory corruption and denial of service, consistent with VC:N/VI:L. No EPSS score, no CISA KEV listing, and no explicit POC/exploit-code flag were provided in the input; a detailed third-party technical writeup (hackmd) and an upstream issue exist, which raise the practical likelihood that a crash/PoC is reproducible, but that is INFERRED from the references, not a confirmed weaponized exploit. There is no conflict among the signals - local vector plus DoS-centric impact plus absence of KEV/EPSS all point to a low real-world exploitation urgency. Priority should be driven by patch hygiene for anyone embedding AdPlug, not emergency response. |
| Exploit ScenarioDerived | An attacker crafts a malicious .ksm AdLib module whose notes are arranged to share a single time slot, then distributes it (e.g., via a music archive or download) to a victim who opens or plays it in an application using AdPlug ≤2.4. When CksmPlayer::update() processes the file, it writes past the fixed databuf[2048] array, corrupting the heap and crashing the player. A detailed technical writeup exists, but no confirmed weaponized exploit code is referenced in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
AdPlug through 2.4 contains a heap-based buffer overflow in the KSM (Ken Silverman Music) module player, CksmPlayer::update() in src/ksm.cpp, where register writes accumulated for a single time slot overflow the fixed databuf[2048] array and corrupt the heap-resident player object. A crafted .ksm module whose notes share one time slot triggers the out-of-bounds write without authentication (CVSS PR:N), but the attacker-supplied file must reach and be opened or played on the target (AV:L, UI:R/UI:P), so the real-world exposure is local and interaction-dependent, with the dominant impact being availability loss (A:H) and minor integrity effects (I:L) rather than code execution. An upstream fix is available in GitHub PR #295; no public exploit code was identified at time of analysis.
RemediationAI
Upstream fix available (PR/commit); a released patched version is not independently confirmed in the provided data - apply the vendor patch or upgrade AdPlug to a build that includes https://github.com/adplug/adplug/pull/295, which adds the bufnum + 15 > sizeof(databuf) bounds check in src/ksm.cpp plus related hardening in ksm.cpp, ksm.h, coktel.cpp, rat.cpp, sop.cpp and vgm.cpp (see also the issue at https://github.com/adplug/adplug/issues/292). Until a patched build can be deployed, stop processing untrusted .ksm files: block or strip .ksm input at the application boundary or remove KSM support from the build, accepting the trade-off that legitimate KSM playback is lost; alternatively, sandbox the parsing process (run the player as a low-privilege user, restrict its filesystem and memory access with seccomp/AppArmor/container isolation, and keep ASLR enabled) so that the resulting heap corruption degrades to a contained crash instead of host compromise - this reduces, but does not eliminate, the denial-of-service impact (A:H) and the minor memory-corruption effects (I:L). Rewriting or sanitizing malformed .ksm files is not a reliable mitigation because the trigger is a valid structural property of the format (multiple notes in one time slot), not an obvious file-level anomaly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AdPlug is a C++ library for playing AdLib/OPL2-based music formats, and the KSM handler (CksmPlayer, src/ksm.cpp, referenced lines 99-229) converts parsed module events into OPL register writes buffered in the fixed-size member array databuf[2048]. The root cause is CWE-787 (out-of-bounds write): the per-time-slot write counter (bufnum) is never checked against sizeof(databuf) before writes, so a .ksm file that packs many notes into one time slot drives the index past the 2048-byte boundary and overflows into adjacent heap memory occupied by the player object. The upstream diff in PR #295 confirms the class of defect by adding an explicit guard (if (bufnum + 15 > sizeof(databuf)) break;), and also hardens related indexing issues in the same codebase (adlibfreq array resized 63 to 64, a zero-division guard on quanter, instrument-range checks in rat.cpp, and bounds checks in coktel.cpp, sop.cpp and vgm.cpp). The single CPE entry cpe:2.3:a:adplug:adplug:*:*:*:*:*:*:*:* reflects that all released AdPlug versions up to and including 2.4 are affected.
Know when Adplug gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Victim must open a local crafted file (AV:L, UI:R); no privileges needed (PR:N); impact is primarily a crash (A:H) with limited heap integrity effect (I:L) and no data disclosure (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h. Rated critical severity (CVSS 9.8), this vulnerability
An issue was discovered in AdPlug 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp. Rated high severity (CVSS 8.8),
AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp. Rated high severity (CVSS 8.8),
AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp. Rated high severity (CVSS 8.8),
AdPlug 2.3.1 has a heap-based buffer overflow in CmkjPlayer::load() in mkj.cpp. Rated high severity (CVSS 8.8), this vul
AdPlug 2.3.1 has a heap-based buffer overflow in CdtmLoader::load() in dtm.cpp. Rated high severity (CVSS 8.8), this vul
AdPlug 2.3.1 has a heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp. Rated high severity (
Heap out-of-bounds read in AdPlug through 2.4 can crash an application that parses a truncated TwinTeam DMO file, yieldi
Out-of-bounds read in AdPlug through 2.4 lets a crafted XSM file (with 'ofTAZ!' signature and a song byte of 0x80 or hig
Exploit-DB