libmodplug CVE-2026-111270

Exploitation requires an application built against libmodplug through 0.8.9.1 to parse an attacker-supplied DSM module file whose header declares more than 240 PATT (pattern) chunks, or whose patt_len field wraps, so that nPat is never bounded by MAX_PATTERNS in CSoundFile::ReadDSM(). The practical trigger is a victim opening or loading the crafted file (CVSS UI:P), which limits exploitation to workflows that process untrusted module files. Impact is bounded to heap corruption and process crash (availability) with only limited integrity effect and no confidentiality disclosure; no authentication is required, but no remote-service exposure exists absent an application that ingests such files.

Signals converge on a medium-severity memory-safety defect, not a top-tier priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H, base 6.9) frames this as a locally-triggered flaw requiring a victim to process a malicious file, with impact dominated by availability (VA:H, i.e. process crash) and only limited integrity (VI:L) and zero confidentiality (VC:N). The CWE-787 out-of-bounds write theoretically raises the specter of code execution, but the description and the vendor advisory characterize the realistic outcome as heap corruption that 'crash[es] the consuming process,' which is consistent with the VA:H / VI:L / VC:N emphasis rather than a full RCE. No EPSS score, KEV listing, or confirmed public exploit is present in the input, so there is no evidence of active or at-scale exploitation; the attached hackmd write-up is a technical analysis whose exploit-code status is not confirmed by the provided data. Note one tension to verify: the 4.0 vector uses AV:L (local) while the attack is actually driven by delivering a crafted file that the target application parses - the 'local' rating reflects that the attacker does not touch the network directly, not that physical/shell access is needed. Overall this reads as a genuine but moderate bug: patch during normal cycles, prioritize only where libmodplug parses untrusted/attacker-supplied module files.

An attacker crafts a malicious DSM module file containing more than 240 PATT chunks (or a wrapping patt_len value) and delivers it to a victim who opens it in a media player or application that uses libmodplug ≤0.8.9.1. When CSoundFile::ReadDSM() parses the file without validating nPat against MAX_PATTERNS, it writes past the allocated pattern array, corrupting the heap and crashing the process. No public exploit has been identified in the provided data, though a technical write-up describing the flaw is referenced.