EUVD-2026-102292Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft .mtm file with channel count >32
-
DeliveryDeliver module to victim
-
ExploitVictim loads file in libmikmod app
-
ExecutionMTM_Load reads past static pat array
-
ImpactTrack indices corrupted, application crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim to load an attacker-supplied .mtm MultiTracker module file (channel count declared above 32) in an application that uses libmikmod version 3.3.15 or earlier; the unclamped channel count causes MTM_Load() to read past the static pat array. Exploitation is strictly LOCAL (AV:L) and gated by user interaction (UI:P) - the attacker cannot trigger it remotely without the victim opening or auto-processing the malicious file. Limiting factors: impact is confined to a crash of the loading process (availability only, no code execution or data disclosure credited), and only software statically or dynamically linked against the vulnerable libmikmod versions is affected. |
| Impact | This is a medium-severity denial-of-service issue (CVSS 4.0 base 6.8), not a high-priority remote threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) tells a consistent story: exploitation is LOCAL and requires passive user interaction (a victim must load a malicious .mtm file in an application built on libmikmod), requires no privileges, and produces ONLY an availability impact (VA:H) - a crash - with no confidentiality (VC:N) or integrity (VI:N) impact. Crucially, despite the 'Information Disclosure' tag and the vulnerability being an out-of-bounds READ (CWE-125), the authoritative CVSS vector sets VC:N, meaning no attacker-controlled data disclosure is credited; the realized impact is memory corruption of track indices leading to a crash. EPSS is NOT provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no POC flag is set in the input (though a HackMD technical write-up is referenced). Net: a genuine but low-urgency bug - patch during normal cycles; prioritize only where untrusted module files are routinely loaded (e.g., media players or games that auto-parse user-supplied .mtm files). |
| Exploit ScenarioDerived | An attacker crafts a malicious .mtm MultiTracker module declaring a channel count greater than 32 and delivers it to a victim (via download, email, or a game mod-pack). When the victim opens or auto-loads the file in any application linked against libmikmod ≤3.3.15, MTM_Load() reads past the static pat array, corrupting track indices and crashing the application. A HackMD technical write-up documenting the flaw is publicly referenced, but no weaponized exploit is confirmed in the input data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Loading a crafted MultiTracker (.mtm) module file with a declared channel count above 32 in applications linked against libmikmod through 3.3.15 triggers an out-of-bounds read in MTM_Load(), crashing the process. The flaw is a medium-severity local denial-of-service issue (CVSS 4.0 base 6.8) requiring user interaction to open or process the malicious file; no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, avoid loading untrusted .mtm files in applications using libmikmod, or implement input validation to reject .mtm files with a channel count greater than 32 before passing them to the library. Alternatively, restrict the file types accepted by the application to exclude MultiTracker modules until a fix is available. These mitigations may break legitimate .mtm playback functionality. Monitor the vendor repository (https://github.com/sezero/mikmod) for updates. Refer to the VulnCheck advisory for further details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libmikmod is a portable sound library for playing tracker music formats, including the MultiTracker (MTM) module format. The vulnerability is a CWE-125 out-of-bounds read in the MTM_Load() function (see load_mtm.c lines 257-261 in the referenced commit). The loader fails to clamp the declared channel count, allowing a value greater than 32 to index past the static pat array, which can corrupt track indices and cause a crash. The CPE cpe:2.3:a:sezero:libmikmod:*:*:*:*:*:*:*:* confirms all versions up to 3.3.15 are affected. Although the advisory tags include 'Information Disclosure', the independent assessment assigns no confidentiality or integrity impact, crediting only availability (crash).
Know when Libmikmod gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local file parsing requires the victim to open a crafted module (AV:L, UI:R); no auth needed (PR:N); out-of-bounds read only crashes the app, so C:N/I:N and A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Heap buffer overflow in libmikmod's Oktalyzer (.okt) loader lets a crafted module corrupt heap memory and potentially ac
Heap buffer overflow in libmikmod before 3.3.14 is triggered when an application linked against the library parses a cra
A heap out-of-bounds read in libmikmod's IMF_Load() loader (CWE-125) lets a crafted Imago Orpheus (IMF) module map notes
A heap out-of-bounds read in the Impulse Tracker loader of libmikmod before 3.3.14 lets a crafted .it module drive the p
Exploit-DB