Bug 2549251 (CVE-2026-108577)

Summary: CVE-2026-108577 libmodplug: libmodplug: Denial of Service via excessive resource consumption in ABC music format parser
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libmodplug. A remote attacker could exploit this issue by enticing a user or application to process a specially crafted ABC music format file handled by the abc_add_gchord function. Successful exploitation causes excessive resource consumption, resulting in a denial of service (DoS) where the application hangs or stops responding.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2550242, 2550243, 2550239, 2550240, 2550241    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-11 12:43:35 UTC 
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.