EUVD-2026-102351
GHSA-5f64-5878-cg28
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft XSM file with ofTAZ! signature and song byte ≥0x80
-
DeliveryDeliver file to victim via download or share
-
ExploitVictim plays file in AdPlug-based player
-
ExecutionNegative note index reads before note_table
-
ImpactOut-of-bounds read crashes application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open or play an attacker-supplied XSM file within an application that uses the AdPlug library; the file must contain the 'ofTAZ!' signature and a song byte of 0x80 or higher to produce the negative note index. Limiting factors: the attack vector is local (the malicious file must reach and be processed on the target system), passive user interaction is required (the file must be played), and the impact is limited to crashing the application - there is no code execution, privilege escalation, or data disclosure indicated. No special non-default configuration is needed beyond using AdPlug to parse XSM-format files. |
| Impact | This is a genuinely low-to-moderate priority issue, not a high-severity emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 but the impact is confined to availability (VA:H) - a crash - with no confidentiality or integrity impact (VC:N/VI:N). The attack vector is LOCAL (AV:L) and requires passive user interaction (UI:P): a victim must obtain and play a maliciously crafted XSM file, so this cannot be triggered remotely or automatically against a service. A public POC exists (reported by VulnCheck), which raises practical reproducibility, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The signals are internally consistent: a file-parsing memory-safety bug in a desktop/library media component that results in a crash. Note a labeling tension - the CVE is tagged 'Information Disclosure' and is an out-of-bounds READ (CWE-125), yet both the description ('may crash affected applications') and the CVSS (VC:N) indicate the realistic outcome is denial of service, not data leakage. Net: a real, confirmed bug worth patching in software bundling AdPlug, but low operational urgency given local vector, user-interaction requirement, and crash-only impact. |
| Exploit ScenarioDerived | An attacker crafts a malicious AdLib XSM music file containing the 'ofTAZ!' signature and a song byte of 0x80 or higher, then distributes it (e.g., via download, email, or a music-file archive). When a victim opens or plays the file in an application using the AdPlug library, the negative note index causes an out-of-bounds read before note_table, crashing the application. A public proof-of-concept exploit is available, making reproduction straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Out-of-bounds read in AdPlug through 2.4 lets a crafted XSM file (with 'ofTAZ!' signature and a song byte of 0x80 or higher) crash applications that play the file, requiring victim interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); the CVSS 4.0 score is 6.8 while the independent CVSS 3.1 assessment is 5.4 (AV:L/AC:L/PR:N/UI:R, availability-only). The vulnerability is a low-to-moderate priority local denial-of-service issue, with no code execution, privilege escalation, or data disclosure per the assessed impact (C:N/I:N/A:H).
RemediationAI
No vendor-released patch identified at time of analysis; the CPE indicates all versions through 2.4 are affected. Monitor the AdPlug GitHub repository (https://github.com/adplug/adplug) for a fixed release, and apply a local code patch to bounds-check the note index in src/xsm.cpp if you must continue using the library. As a compensating control, avoid opening or playing untrusted XSM files with AdPlug-based applications, or sandbox the player (e.g., run it under a restricted user account or an application sandbox) to limit the impact of a crash; the trade-off is reduced functionality for untrusted content. If the application allows, disable XSM format support entirely, though this removes legitimate playback capability. Validate files before parsing by rejecting XSM files that carry the 'ofTAZ!' signature and a song byte of 0x80 or higher, but note that this check is specific to the known exploit pattern and may not cover variants. Follow the vendor advisory at https://www.vulncheck.com/advisories/adplug-through-2.4-out-of-bounds-read-via-cxsmplayer-play-note-in-xsm-files for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AdPlug is a C++ library for playing AdLib/OPL2 music formats, including the XSM format. The flaw resides in src/xsm.cpp, where a negative note index (caused by a song byte of 0x80 or higher) is used to read before the note_table global buffer, triggering a global-buffer-overflow read classified as CWE-125 (out-of-bounds read). The affected CPE is cpe:2.3:a:adplug:adplug:*:*:*:*:*:*:*:*, covering all versions through 2.4. Exploitation requires the victim to open or play an attacker-supplied XSM file within an application that uses AdPlug; no special non-default configuration is needed beyond using AdPlug to parse XSM-format files. The public exploit reference points to a HackMD writeup whose title mentions an out-of-bounds write, which may indicate a related code path or a labeling discrepancy, but the CVE and the independent assessment describe strictly an out-of-bounds read that can crash the application. Although the supplied tags include 'Information Disclosure,' the assessed vector shows no confidentiality impact (C:N), so the practical impact is denial of service.
Know when Adplug gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Malicious file must be locally processed (AV:L) and played by the user (UI:R); no privileges needed (PR:N); impact is a crash only, so A:H with C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h. Rated critical severity (CVSS 9.8), this vulnerability
An issue was discovered in AdPlug 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp. Rated high severity (CVSS 8.8),
AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp. Rated high severity (CVSS 8.8),
AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp. Rated high severity (CVSS 8.8),
AdPlug 2.3.1 has a heap-based buffer overflow in CmkjPlayer::load() in mkj.cpp. Rated high severity (CVSS 8.8), this vul
AdPlug 2.3.1 has a heap-based buffer overflow in CdtmLoader::load() in dtm.cpp. Rated high severity (CVSS 8.8), this vul
AdPlug 2.3.1 has a heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp. Rated high severity (
Heap out-of-bounds read in AdPlug through 2.4 can crash an application that parses a truncated TwinTeam DMO file, yieldi
AdPlug through 2.4 contains a heap-based buffer overflow in the KSM (Ken Silverman Music) module player, CksmPlayer::upd
Exploit-DB