Libmikmod
Monthly
Heap buffer overflow in libmikmod's Oktalyzer (.okt) loader lets a crafted module corrupt heap memory and potentially achieve code execution, because a 16-bit track-count field (numtrk = numpat * numchn) can be made to wrap while pattern data is still written for the full, unwrapped track count. Any application linked against libmikmod before 3.3.14 is affected, and exploitation requires the victim to open or otherwise process an attacker-supplied .okt file, matching the independently assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R (7.8) rather than a remotely reachable condition. No public exploit identified at time of analysis, and the 3.3.14 release rejects overflowing track counts outright.
Heap buffer overflow in libmikmod before 3.3.14 is triggered when an application linked against the library parses a crafted DSM module whose numchn and numpat header fields produce a product that overflows the 16-bit UWORD truncation in DSM_Load(), corrupting heap memory and potentially enabling code execution. The issue is local and file-based: an attacker must deliver a malicious DSM file and a victim must open or play it, so it is not a drive-by remote threat; no authentication or special privileges are required, and no public exploit has been identified at time of analysis. A vendor-released patch is available in libmikmod 3.3.14.
A heap out-of-bounds read in libmikmod's IMF_Load() loader (CWE-125) lets a crafted Imago Orpheus (IMF) module map notes to sample indices far past the allocated sample table, crashing any application that parses the file with libmikmod 3.3.15 or earlier. Exploitation is local and requires the target application to load attacker-supplied IMF content, with no privileges or authentication needed, so the practical impact is denial of service against media players, trackers, and game engines that link the library. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 6.8 reflects high availability impact with no demonstrated confidentiality or integrity loss.
Loading a crafted MultiTracker (.mtm) module file with a declared channel count above 32 in applications linked against libmikmod through 3.3.15 triggers an out-of-bounds read in MTM_Load(), crashing the process. The flaw is a medium-severity local denial-of-service issue (CVSS 4.0 base 6.8) requiring user interaction to open or process the malicious file; no public exploit code or active exploitation has been identified at time of analysis.
A heap out-of-bounds read in the Impulse Tracker loader of libmikmod before 3.3.14 lets a crafted .it module drive the parser past its pattern buffer, crashing the host application. Any program statically or dynamically linking the vulnerable library - classic MikMod-based players, games, and media tools - is exposed when it opens an untrusted module. The trigger is an oversized pattern of more than 200 rows, which overruns the hardcoded itpat allocation (200*64 ITNOTE entries) and causes IT_ConvertTrack() to read adjacent heap memory. The assessed impact is availability only (AV:L, UI:P, A:H) with no confidentiality or integrity loss, so there is no public exploit identified at time of analysis; the practical risk is a local denial of service against applications that parse attacker-supplied tracker files.
Heap buffer overflow in libmikmod's Oktalyzer (.okt) loader lets a crafted module corrupt heap memory and potentially achieve code execution, because a 16-bit track-count field (numtrk = numpat * numchn) can be made to wrap while pattern data is still written for the full, unwrapped track count. Any application linked against libmikmod before 3.3.14 is affected, and exploitation requires the victim to open or otherwise process an attacker-supplied .okt file, matching the independently assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R (7.8) rather than a remotely reachable condition. No public exploit identified at time of analysis, and the 3.3.14 release rejects overflowing track counts outright.
Heap buffer overflow in libmikmod before 3.3.14 is triggered when an application linked against the library parses a crafted DSM module whose numchn and numpat header fields produce a product that overflows the 16-bit UWORD truncation in DSM_Load(), corrupting heap memory and potentially enabling code execution. The issue is local and file-based: an attacker must deliver a malicious DSM file and a victim must open or play it, so it is not a drive-by remote threat; no authentication or special privileges are required, and no public exploit has been identified at time of analysis. A vendor-released patch is available in libmikmod 3.3.14.
A heap out-of-bounds read in libmikmod's IMF_Load() loader (CWE-125) lets a crafted Imago Orpheus (IMF) module map notes to sample indices far past the allocated sample table, crashing any application that parses the file with libmikmod 3.3.15 or earlier. Exploitation is local and requires the target application to load attacker-supplied IMF content, with no privileges or authentication needed, so the practical impact is denial of service against media players, trackers, and game engines that link the library. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 6.8 reflects high availability impact with no demonstrated confidentiality or integrity loss.
Loading a crafted MultiTracker (.mtm) module file with a declared channel count above 32 in applications linked against libmikmod through 3.3.15 triggers an out-of-bounds read in MTM_Load(), crashing the process. The flaw is a medium-severity local denial-of-service issue (CVSS 4.0 base 6.8) requiring user interaction to open or process the malicious file; no public exploit code or active exploitation has been identified at time of analysis.
A heap out-of-bounds read in the Impulse Tracker loader of libmikmod before 3.3.14 lets a crafted .it module drive the parser past its pattern buffer, crashing the host application. Any program statically or dynamically linking the vulnerable library - classic MikMod-based players, games, and media tools - is exposed when it opens an untrusted module. The trigger is an oversized pattern of more than 200 rows, which overruns the hardcoded itpat allocation (200*64 ITNOTE entries) and causes IT_ConvertTrack() to read adjacent heap memory. The assessed impact is availability only (AV:L, UI:P, A:H) with no confidentiality or integrity loss, so there is no public exploit identified at time of analysis; the practical risk is a local denial of service against applications that parse attacker-supplied tracker files.