Description
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Konstanty Bialkowski libmodplug
Default version status: unaffected
0 to ≤ 0.8.9.1affected
pkg:github/Konstanty/libmodplugReferences
- https://hackmd.io/@haind-pwn/libmodplug-dsm-pattern-oob-write ↗
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_dsm.cpp#L130-L139 ↗
- https://github.com/Konstanty/libmodplug ↗
- https://www.vulncheck.com/advisories/libmodplug-through-0.8.9.1-heap-out-of-bounds-write-via-csoundfile-readdsm ↗
- https://hackmd.io/@haind-pwn/cve-2026-111270-111271-libmodplug-dsm-pattern-oob-write ↗