AdPlug CVE-2026-110877

Exploitation requires an attacker-supplied, specially crafted TwinTeam DMO file that is truncated to 12 or 13 bytes yet still passes the dmo_unpacker::decrypt() check, and the file must be opened/loaded through CAdPlug::factory so that CdmoLoader::load() processes it. Key LIMITING factors: the attack vector is LOCAL (the malicious file must reach the victim's machine), and it requires USER INTERACTION - the victim must actively open or load the file in an AdPlug-based application; there is no remote, network-triggered, or automatic path. No authentication or special privileges are needed, but exploitation only affects the process parsing the file and yields a crash rather than code execution or data disclosure.

This is a genuine but low-priority memory-safety defect, not an urgent crisis. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, base 6.8) describes a local, low-complexity, unauthenticated flaw requiring passive user interaction (opening a crafted file), with impact limited to availability (VA:H) and explicitly no confidentiality or integrity impact (VC:N/VI:N) - consistent with CWE-125 (out-of-bounds read) that reads past a heap allocation and 'potentially crash[es] the application' rather than leaking data to the attacker. Note a tension in the signals: AdPlug is tagged 'Information Disclosure,' but the official CVSS sets VC:N, implying the over-read bytes are not actually returned to the attacker - the realistic outcome is a denial-of-service crash, not data exfiltration; treat the disclosure framing with caution. A public POC exists (reported by VulnCheck), which raises reproducibility, but there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation. Because the attack vector is local and demands that a victim open a malicious file, real-world risk is modest and depends entirely on untrusted-file workflows. One caveat on source integrity: the linked 'exploit' reference (hackmd 'adplug-ksm-note-loop-databuf-oob-write') describes a KSM out-of-bounds WRITE, which is a different code path than the CdmoLoader::load() OOB READ named in this CVE - the POC relevance to THIS specific bug is unverified.

An attacker crafts a truncated 12- or 13-byte TwinTeam DMO file that still passes dmo_unpacker::decrypt() and distributes it as a music file. When a victim opens it in an application that uses AdPlug (via CAdPlug::factory), CdmoLoader::load() reads beyond the packed_module heap buffer, crashing the player. A public POC is available, so reproduction is straightforward, though exploitation requires local delivery and the victim opening the file.