EUVD-2026-102293Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted IMF module file
-
ExploitUser loads file in libmikmod app
-
ExecutionOut-of-bounds heap read in IMF_Load()
-
ImpactApplication crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim application to parse an attacker-supplied, crafted IMF module file via libmikmod's IMF_Load() loader. The crafted file must set the linear-period header flag and map notes to out-of-range sample indices, so that noteindex indexes far past the heap allocation and reads out of bounds. Limiting factors: there is no network vector (AV:L) - the attacker cannot trigger it remotely without delivering a file, and user/application action to load the file is required (UI:P), though no authentication or special privileges are needed (PR:N). Any application linking libmikmod 3.3.15 or earlier that accepts IMF input (default loader set) is affected; the practical impact is a crash of that application. |
| Impact | The input CVSS 4.0 score is 6.8 (Medium). The vector (AV:L/AC:L/PR:N/UI:P, VC:N/VI:N/VA:H) tells a consistent and important story: this is an availability-only defect - an application crash (VA:H) with no confidentiality or integrity impact. Although the CWE is CWE-125 (out-of-bounds read), both the official vector (VC:N) and the description frame the outcome as a crash rather than memory disclosure, so this should be treated as a parser denial-of-service, not an info-leak. Exploitation is not remote-network: AV:L plus UI:P means an attacker must get a victim/application to open a crafted IMF module file, so it is not wormable or mass-exploitable. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no signal of active or widespread exploitation; however, a detailed public technical write-up (hackmd) documenting the exact trigger exists, which materially lowers the bar to reproduce. Net assessment: a real but moderate-priority memory-safety DoS affecting software that auto-parses untrusted module files - patch in normal cycles, prioritize higher only where libmikmod ingests attacker-supplied files unattended. |
| Exploit ScenarioDerived | An attacker distributes a malicious IMF module file through a game mod pack, download site, or music archive. When a victim opens it in a media player, game, or tool that links libmikmod 3.3.15 or earlier, the IMF_Load() parser performs an out-of-bounds heap read and crashes the application. A public technical write-up describing the trigger (linear-period flag plus out-of-range sample mapping) exists, making reproduction straightforward even though no packaged exploit tool is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
A heap out-of-bounds read in libmikmod's IMF_Load() loader (CWE-125) lets a crafted Imago Orpheus (IMF) module map notes to sample indices far past the allocated sample table, crashing any application that parses the file with libmikmod 3.3.15 or earlier. Exploitation is local and requires the target application to load attacker-supplied IMF content, with no privileges or authentication needed, so the practical impact is denial of service against media players, trackers, and game engines that link the library. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 6.8 reflects high availability impact with no demonstrated confidentiality or integrity loss.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed version number is stated in the supplied references, so the first action is to track the upstream project at github.com/sezero/mikmod and the VulnCheck advisory (https://www.vulncheck.com/advisories/libmikmod-through-3.3.15-heap-out-of-bounds-read-via-imf-load) and upgrade to a release newer than 3.3.15 as soon as one is published; the technical write-up at https://hackmd.io/@haind-pwn/libmikmod-mtm-imf-loader-oob-read may help confirm when the IMF_Load() bounds check lands. Until then, the most effective compensating control is to stop the library from parsing the vulnerable format: call MikMod_RegisterAllDrivers/MikMod_RegisterLoader selectively and omit the IMF loader (or build with IMF support disabled), which removes the attack surface entirely at the cost of losing Imago Orpheus (.imf) playback in that application. Where IMF playback must be retained, sanitize or re-encode untrusted IMF files with a trusted converter before they reach libmikmod, and enforce file-type allow-listing at the ingestion point (mail attachments, downloads, browsed archives, game asset droppers) since the attacker must deliver a file and induce the user or application to load it. Additional hardening includes running the parsing process as a low-privilege, sandboxed user inside a container or seccomp-restricted sandbox and performing module parsing in a disposable child process so a crash does not take down the parent workflow, and compiling the consumer application with address sanitizer or hardened allocators during testing to detect the OOB read; note that these measures detect or contain the fault and do not fix the underlying missing bounds check, so they should be treated as temporary until an upstream release is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libmikmod is a portable module-player library that ships a set of format loaders, one of which handles the Imago Orpheus (IMF) module format via IMF_Load() in libmikmod/loaders/load_imf.c. In normal operation the loader builds a note-to-sample mapping and uses a noteindex value to look up entries in the heap-allocated sample/note structures; the vulnerable code path (referenced around lines 702-712 of the upstream source) does not validate the sample index derived from the module's note data, particularly when the header's linear-period flag is set, so a crafted file can force noteindex to index far beyond the end of the allocation. This is a classic CWE-125 out-of-bounds read: the out-of-range data is consumed internally as an index/pointer rather than returned to the caller, which is why the assessed impact is a crash of the host application (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) rather than a reliable information leak, despite the advisory being tagged with information disclosure. The only CPE supplied is cpe:2.3:a:sezero:libmikmod:*:*:*:*:*:*:*:*, a vendor-wildcard entry covering the sezero-maintained libmikmod code line through the 3.3.15 release; the referenced GitHub source link documents the affected IMF_Load() logic, and a public technical write-up is available at hackmd.io/@haind-pwn/libmikmod-mtm-imf-loader-oob-read.
Know when Libmikmod gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Attacker must get the victim to open a crafted file (AV:L, UI:R) with no auth (PR:N); the observed effect is an application crash, so A:H while C:N and I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Heap buffer overflow in libmikmod's Oktalyzer (.okt) loader lets a crafted module corrupt heap memory and potentially ac
Heap buffer overflow in libmikmod before 3.3.14 is triggered when an application linked against the library parses a cra
Loading a crafted MultiTracker (.mtm) module file with a declared channel count above 32 in applications linked against
A heap out-of-bounds read in the Impulse Tracker loader of libmikmod before 3.3.14 lets a crafted .it module drive the p
Exploit-DB