libmodplug CVE-2026-75904

Exploitation requires a user to open or process a crafted MIDI file using an application that links against libmodplug through 0.8.9.1 - user interaction is required and confirmed by the CVSS 4.0 UI:P metric. The specific trigger is a MIDI note event processed through MID_ReadPatterns before any program-change event has assigned an instrument to the track, so that smpno retains its zero-initialized value when pat_smplooped subtracts one to form the array index. The attack vector is local (AV:L per CVSS 4.0), meaning the malicious file must be delivered to and opened on the target system - no direct network-reachable path exists at the library level, though applications that expose MIDI parsing to remote file uploads would extend this vector. No privileges are required at the library level, but the host application's own access controls govern who can submit files. Exploitation is limited to reading exactly one byte of adjacent static storage; no code execution, memory corruption, or availability impact is described or implied by the available data.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 4.8) accurately reflects the constrained impact: local attack vector, user interaction required, and only low confidentiality exposure limited to one byte of adjacent static memory with no integrity or availability consequences. The vulnerability is absent from the CISA KEV catalog, no weaponized exploit code has been released, and EPSS data was not available in the intelligence provided - all signals pointing to low urgency. Even a mid-sized municipal IT team in inowroclaw deploying MIDI-capable media software would face minimal real-world risk from this vulnerability in isolation, as the one-byte disclosure does not provide a standalone path to code execution or privilege escalation. The primary threat model is applications that parse untrusted MIDI content from external sources, where the leaked static-memory byte could theoretically assist in information-disclosure chains, but no such chained scenario is documented. No patch exists at time of analysis; the only upstream artifact is an open GitHub issue. The low CVSS score is consistent with real-world risk, and this should be treated as a medium-term tracking item rather than an emergency response.

An attacker crafts a minimal 32-byte MIDI file containing a note event that arrives before any program-change event, leaving smpno at its zero-initialized default when pat_smplooped is called; when a user opens this file in a media player or game that links against libmodplug through 0.8.9.1, the library reads one byte before the pat_loops static array, leaking adjacent static memory into the application's playback state. The technical description in the GitHub issue and source code references provides sufficient detail to reconstruct this trigger condition, though no public proof-of-concept code has been released at time of analysis.