libmikmod EUVD-2026-93390

Exploitation requires a victim application that links libmikmod before 3.3.14 to load/parse an attacker-supplied Impulse Tracker (.it) module whose pattern data exceeds the hardcoded 200-row limit (itpat is allocated as 200*64 ITNOTE entries in load_it.c); the oversized pattern is the exact trigger. Limiting factors: the vector is local (AV:L) and demands passive user interaction (UI:P) - the victim must open or play the crafted file - there is no network-remote path, and impact is confined to a crash (availability only), with no confidentiality/integrity effect and no authentication needed. Risk is therefore bounded to environments where untrusted module files are opened in vulnerable libmikmod-based software.

This is a moderate, defensively-scoped issue rather than a top-tier priority. The vendor-provided CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) describes a local, low-complexity, unauthenticated flaw that requires passive user interaction and whose only impact is availability (VA:H) - i.e. an application crash - with no confidentiality or integrity impact (VC:N/VI:N). This is consistent with a CWE-125 out-of-bounds READ whose practical outcome, per the description and the source-code evidence, is a crash when IT_ConvertTrack() walks past the fixed 200-row itpat buffer. Note a tension worth flagging: the CVE is tagged 'Information Disclosure' and the primitive is an adjacent-heap read, yet the CVSS sets VC:N and the description states the result is a crash - so the realistic impact is denial of service, not attacker-usable data leakage; verify with the vendor advisory if leakage matters to you. No EPSS score was supplied, KEV status is NO (not CISA-listed), and no public exploit was provided in the intelligence set, so exploitation is 'no public exploit identified at time of analysis.' Combined with the local vector and required user interaction, real-world risk is low-to-moderate: it is a file-parsing DoS against software embedding a somewhat niche audio library, not a remotely-wormable or data-exfiltration bug.

An attacker crafts a malicious Impulse Tracker (.it) module containing more than 200 pattern rows and distributes it (e.g. as a downloadable song file or game mod). When a victim opens or plays the file in an application built on libmikmod before 3.3.14, IT_ConvertTrack() reads past the 200-row itpat heap buffer, reading adjacent heap memory and crashing the host application. No public exploit code was identified in the provided intelligence.