Description
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf_destroy() to free attacker-chosen pointers and crash the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
schismtracker Schism Tracker
Default version status: unaffected
0 to ≤ 20260524affected
pkg:github/schismtracker/schismtrackerReferences
- https://hackmd.io/@haindpwn/schismtracker-ult-sample-count-oob-write ↗
- https://github.com/schismtracker/schismtracker/blob/74215ae300b555928332e03152dfcdc898f96ca6/fmt/ult.c#L319-L330 ↗
- https://github.com/schismtracker/schismtracker ↗
- https://www.vulncheck.com/advisories/schism-tracker-through-20260524-heap-out-of-bounds-write-via-ult-loader ↗