Description

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-18T16:18:22.540Z",
  "pubdate": "2026-08-18T16:18:22.540Z",
  "executiveSummary": "libmodplug through versions 0.8.9.1 suffers from an out-of-bounds read vulnerability located within the pat_smplooped function in src/load_pat.cpp.\nThe flaw allows an attacker to trigger an out-of-bounds memory read by supplying a specially crafted 32-byte MIDI file to the library's public ModPlug_Load entry point.\nThe impact of this vulnerability involves the reading of adjacent static storage, specifically the 191-byte static array pat_loops, which subsequently influences playback state determination regarding whether a note event is treated as looping.\nNo authentication or specific privileges are required to exploit this issue, as the vulnerability is triggered locally or via ingestion of untrusted media files by applications utilizing the libmodplug library.\nRisk implications include unintended control flow alterations during media playback driven by adjacent memory contents, potentially leading to incorrect execution states or minor information disclosure depending on context.",
  "technicalDetails": "The vulnerability resides in the pat_smplooped function within src/load_pat.cpp of libmodplug through 0.8.9.1.\nThe root cause of the out-of-bounds read is improper input validation of sample indices derived from parsed MIDI events.\nSpecifically, the function validates only the upper bound of its sample index against MAXSMP and subsequently subtracts one before indexing the 191-byte static array pat_loops.\nWhen a sample index of zero is processed, the subtraction operation results in an index of -1, leading to a read operation one byte before the start of the static array pat_loops.\nThe index corresponds to the smpno field of a parsed MIDI event, which is initialized to zero and remains unchanged unless later overwritten from a program-change parameter.\nConsequently, any MIDI event reaching the note test before an instrument is assigned carries a value of zero.\nThe attack flow begins when a malicious or malformed 32-byte MIDI file is supplied to the library's public ModPlug_Load entry point.\nThis execution path traverses through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns, ultimately reaching the vulnerable pat_smplooped function.\nDuring execution, the byte read out of bounds from adjacent static storage dictates whether a note event is treated as looping, thereby allowing adjacent memory contents to directly influence playback state.\nThe vulnerable component is the MIDI parsing and pattern loading subsystem within libmodplug.\nNo authentication or elevated privileges are required to exploit this vulnerability, and it can be triggered whenever an application processes untrusted MIDI files using affected versions of libmodplug."
}