EUVD-2026-96926
GHSA-252h-2265-gp6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious ABC music file
-
DeliveryDeliver to victim or media pipeline
-
ExploitVictim opens file in libmodplug-backed app
-
ExecutionTrigger resource exhaustion in abc_add_gchord
-
ImpactApplication denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a target application using libmodplug (≤0.8.9.1) parse an attacker-supplied file in the ABC Music Format, reaching the abc_add_gchord() code path in src/load_abc.cpp. The CVSS UI:P metric means successful attack depends on the victim opening or an application automatically ingesting the crafted file - there is no unauthenticated server-side auto-trigger. Limiting factors: impact is confined to availability (a crash/hang, VA:L) with no code execution or data disclosure; the affected library is a niche audio-decoding component, so reach depends on whether a deployed product actually embeds libmodplug for ABC parsing; and no patched version is confirmed, so mitigation currently means removing or sandboxing the ABC parsing path. |
| Impact | This is a low-to-moderate priority denial-of-service issue, not a critical threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) describes a network-reachable, low-complexity, unauthenticated flaw whose ONLY impact is limited availability (VA:L) - no confidentiality or integrity loss, and no code execution (CWE-400 resource consumption). The score of 5.3 (medium) is consistent with that single low-impact axis. The exploit-maturity metric E:P indicates publicly available exploit code exists, but the vulnerability is NOT in CISA KEV and there is no evidence of active exploitation. No EPSS score was provided in the input. A key nuance: despite AV:N, exploitation is not fully 'remote push' - the vector carries UI:P (passive user interaction), meaning a victim must open or process a malicious ABC music file, so this behaves more like a client-side file-parsing DoS than a server-side remote crash. The worst realistic outcome is a crash or hang of the application embedding libmodplug, not system compromise. Treat as routine patch-cycle risk unless libmodplug sits in an exposed, automated media-processing pipeline. |
| Exploit ScenarioDerived | An attacker crafts a malformed ABC Music Format file that triggers excessive resource consumption in the abc_add_gchord() function of load_abc.cpp. A victim opens or an application auto-processes the file via software bundling libmodplug, causing the parser to exhaust memory/CPU and crash or hang the host application. Proof-of-concept exploit code is indicated by the CVSS exploit-maturity flag (E:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Crafted ABC Music Format files cause uncontrolled resource consumption in libmodplug up to and including 0.8.9.1, where the abc_add_gchord() routine in src/load_abc.cpp can be driven into excessive CPU/memory use, resulting in a denial-of-service condition (crash or hang) of the hosting application. The issue is remotely triggerable but not self-triggering: per the assessed vector (UI:P/UI:R), an attacker must get a victim or an ingesting application to open the malicious .abc file, and impact is limited to availability (VA:L) with no code execution or data disclosure. Publicly available exploit code exists (CVSS 4.0 E:P proof-of-concept maturity), but there is no confirmed active exploitation (CISA KEV) and no EPSS signal was supplied; the vendor was contacted early but did not respond, so no fixed version is confirmed.
RemediationAI
No vendor-released patch is identified at time of analysis: libmodplug 0.8.9.1 and earlier remain affected, and the maintainer did not respond to the disclosure, so no exact fixed version can be cited. Until an upstream fix or a distribution backport appears (track the VulDB entry https://vuldb.com/vuln/416234 and, once available, your distro's security tracker for libmodplug), apply compensating controls: disable or remove ABC Music Format parsing entirely wherever libmodplug is embedded - if your product only needs MOD/XM/IT/S3M playback, strip or refuse the .abc handler and reject application/octet-stream files with ABC headers (trade-off: legitimate ABC playback stops working); restrict which file types users can submit or auto-open and avoid automatic ingestion of untrusted attachments (this blocks the UI:R/UI:P trigger path but relies on user/application discipline); and sandbox or resource-cap the decoder process, e.g. run parsing in a low-privilege child process with strict RLIMIT_AS/RLIMIT_CPU, memory ceilings, and aggressive parse timeouts so a runaway chord expansion is killed instead of taking down the host application (trade-off: legitimate but large or complex files may be aborted, and hard limits need tuning per workload). Substituting an alternative, more actively maintained ABC decoder removes the exposure entirely but requires re-integration and functional testing. Prioritize this as a low-to-moderate availability issue: there is publicly available exploit code but no confirmed active exploitation, so remediation can be scheduled alongside normal maintenance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libmodplug is a widely embedded C/C++ library for decoding tracker/module and related music formats; the affected component here is its ABC Music Format parser in src/load_abc.cpp. The root cause class is CWE-400 (Uncontrolled Resource Consumption): the abc_add_gchord() function processes gchord (guitar chord) directives from the ABC header/body without adequately bounding the work or memory allocated for chord expansion, so a small attacker-supplied file can force disproportionate allocation or looping. This is distinct from memory-corruption bugs - the assessed impact is availability-only (VC:N/VI:N/VA:L, no scope change), so a successful exploit degrades or halts the parsing process rather than achieving code execution. Reachability is the key limiting factor: the flaw only manifests when a deployed product or application actually embeds libmodplug and routes attacker-controlled ABC input to this code path. The provided CPE (cpe:2.3:a:konstanty_bialkowski:libmodplug:*:*:*:*:*:*:*:*) covers the project's releases through 0.8.9.1; because libmodplug is commonly bundled inside media players, audio converters, and GStreamer-style plugins rather than exposed as a service, the practical attack surface is client-side file ingestion.
Know when Libmodplug gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Malicious file must be opened by a victim (UI:R) via libmodplug with no privileges (PR:N); only a limited availability/DoS impact (A:L) with no confidentiality or integrity effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Libmodplug
View allInteger overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers
Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmo
Processing a malicious DSM module file with libmodplug through 0.8.9.1 triggers a heap-based out-of-bounds write in CSou
Crafted AMS (Velvet Studio) module files can crash any application that uses libmodplug 0.8.9.1 or earlier by triggering
Out-of-bounds read in libmodplug through 0.8.9.1 allows a local attacker to cause the library to read one byte before th
Exploit-DB