libxmp EUVD-2026-102362

Exploitation requires that the victim's application built on libxmp (≤4.7.4) load an attacker-supplied, headerless P61A (ProPacker 61A) module through the prowizard depacker path depack_p61a(). The specific trigger is a crafted module declaring 31 samples combined with a 0xffe0 back-reference size word, which drives the off-by-one out-of-bounds stack read. Limiting factors: the attack is LOCAL (the malicious file must reach and be opened/loaded by the victim - UI:P/UI:R), so it cannot be triggered remotely without user action; impact is limited to a minor stack-memory disclosure into sample metadata and/or a loading disruption, with no code execution or data modification. Any application or workflow that never processes untrusted P61A/prowizard modules is not exposed.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 base score of 6.9 (MEDIUM) is consistent with the vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H: exploitation is LOCAL (AV:L) and requires passive user interaction (UI:P) - i.e., a victim must open or load a malicious P61A module file - which substantially limits mass exploitation. The real-world impact is dominated by availability (VA:H, a loading crash/disruption) with only a low confidentiality leak (VC:L), since an off-by-one out-of-bounds READ (CWE-125) can at most leak a small amount of adjacent stack memory into sample metadata; there is no integrity impact (VI:N) and no code execution. No EPSS score, SSVC decision, or KEV entry was provided in the input, and no exploit-code flag is set, so there is no evidence of active or automatable exploitation - consistent with a file-parsing bug that depends on tricking a user into opening crafted content. The signals are internally consistent (local, user-interaction-gated, read-only disclosure plus crash); the only caveat is that a technical write-up hosted on hackmd.io is referenced, which may contain reproduction details even though no formal POC or KEV status is confirmed in the provided data.

An attacker crafts a malicious headerless P61A tracker module declaring 31 samples and a 0xffe0 back-reference size word, then distributes it (e.g., as a music/mod file via download, email, or a game/media bundle). When a victim opens the file in an application that uses libxmp ≤4.7.4, the depack_p61a() routine performs an off-by-one out-of-bounds stack read, leaking adjacent stack memory into the parsed sample metadata or crashing/disrupting the load. A referenced technical write-up describes the bug, but no weaponized public exploit is confirmed in the provided data.