Konstanty Bialkowski
Monthly
Out-of-bounds read in libmodplug through 0.8.9.1 allows a local attacker to cause the library to read one byte before the static `pat_loops` array by supplying a crafted 32-byte MIDI file to the `ModPlug_Load` entry point. The flaw in `pat_smplooped` (src/load_pat.cpp:213-217) arises because `smpno` defaults to zero and the function subtracts one before indexing the array without a lower-bound check, so a MIDI note event processed before any instrument assignment triggers `pat_loops[-1]`. The leaked byte influences loop-playback state and discloses one byte of adjacent static storage; no public exploit code or CISA KEV listing exists at time of analysis.
Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Out-of-bounds read in libmodplug through 0.8.9.1 allows a local attacker to cause the library to read one byte before the static `pat_loops` array by supplying a crafted 32-byte MIDI file to the `ModPlug_Load` entry point. The flaw in `pat_smplooped` (src/load_pat.cpp:213-217) arises because `smpno` defaults to zero and the function subtracts one before indexing the array without a lower-bound check, so a MIDI note event processed before any instrument assignment triggers `pat_loops[-1]`. The leaked byte influences loop-playback state and discloses one byte of adjacent static storage; no public exploit code or CISA KEV listing exists at time of analysis.
Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.