CVE-2026-75904

{"id": "CVE-2026-75904", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75904", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T15:35:53.142035Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Konstanty/libmodplug", "vendor": "Konstanty Bialkowski", "product": "libmodplug", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.8.9.1"}], "packageURL": "pkg:github/Konstanty/libmodplug", "defaultStatus": "unaffected"}]}], "published": "2026-08-18T16:18:22.540", "references": [{"url": "https://github.com/Konstanty/libmodplug", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_mid.cpp#L829", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_pat.cpp#L213-L217", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Konstanty/libmodplug/issues/103", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/libmodplug-out-of-bounds-read-in-pat-smplooped-via-crafted-midi-file", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Konstanty/libmodplug/issues/103", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state."}, {"lang": "es", "value": "libmodplug hasta la versi\u00f3n 0.8.9.1 contiene una lectura fuera de l\u00edmites en pat_smplooped en src/load_pat.cpp. La funci\u00f3n valida solo el l\u00edmite superior de su \u00edndice de muestra contra MAXSMP y luego resta uno antes de indexar el array est\u00e1tico de 191 bytes pat_loops, por lo que un \u00edndice de cero lee pat_loops[-1], un byte antes del array. El \u00edndice es el campo smpno de un evento MIDI parseado, que se inicializa a cero y solo m\u00e1s tarde se sobrescribe desde un par\u00e1metro de cambio de programa, por lo que un evento que llega a la prueba de nota antes de que se asigne un instrumento lleva cero. Un archivo MIDI de 32 bytes suministrado al punto de entrada p\u00fablico ModPlug_Load de la biblioteca impulsa la ruta a trav\u00e9s de CSoundFile::Create, CSoundFile::ReadMID y MID_ReadPatterns hasta la lectura. El byte le\u00eddo fuera de l\u00edmites determina si un evento de nota se trata como en bucle, por lo que el almacenamiento est\u00e1tico adyacente influye en el estado de reproducci\u00f3n."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}