Bug 2517945 (CVE-2026-75904) - CVE-2026-75904 libmodplug: libmodplug: Out-of-bounds read via crafted MIDI file
Summary: CVE-2026-75904 libmodplug: libmodplug: Out-of-bounds read via crafted MIDI file
Keywords:
Status: NEW
Alias: CVE-2026-75904
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2521955 2521958 2521959 2521956 2521957
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-18 15:39 UTC by OSIDB Bzimport
Modified: 2026-08-24 14:08 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-18 15:39:20 UTC
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.


Note You need to log in before you can comment on or make changes to this bug.