Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-111271: libmodplug may expose memory when processing crafted AMS files
CVE-2026-111271 · published 20 days ago
Summary
The libmodplug library (versions up to 0.8.9.1) can read beyond its allocated memory when it opens specially crafted AMS music files. This could let an attacker view nearby data or cause the program that uses libmodplug to crash. Update libmodplug to a newer version or stop accepting untrusted AMS files to protect your systems.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | konstanty bialkowski | libmodplug | <= 0.8.9.1 |
| Ubuntu:Pro:14.04:LTS | canonical | gst-plugins-bad0.10 | All versions |
| Ubuntu:14.04:LTS | canonical | libmodplug | All versions |
| Debian:12 | debian | libmodplug | All versions |
Original advisory text
libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.
References
- https://github.com/Konstanty/libmodplug Third Party Advisory
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd... Third Party Advisory
- https://hackmd.io/@haind-pwn/libmodplug-dsm-pattern-oob-write Third Party Advisory
- https://www.vulncheck.com/advisories/libmodplug-through-0.8.9.1-heap-out-of-boun... Third Party Advisory
- https://ubuntu.com/security/CVE-2026-111271 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-111271 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-111271 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-125Out-of-bounds Read
Timeline
Published15 Oct 2026
Updated4 Nov 2026
First seen15 Oct 2026
Sources
CVE-2026-111271 · NVD
CVE-2026-111271 · MITRE
UBUNTU-CVE-2026-111271 · OSV
DEBIAN-CVE-2026-111271 · OSV
Track software like this
Free during beta