Heap Out-of-Bounds Read in libmikmod Affects Multiple Applications

CVE-2026-105838

What is CVE-2026-105838?

The libmikmod library before version 3.3.14 is susceptible to a heap out-of-bounds read vulnerability within the Impulse Tracker loader. This flaw permits attackers to exploit crafted IT modules containing excessive pattern rows, leading to adjacent heap memory being read. Specifically, when the IT_ConvertTrack() function processes modules with over 200 pattern rows, it inadvertently accesses memory outside the bounds of the intended buffer, potentially causing application crashes and unauthorized data access.

References