Heap Buffer Overflow in libmikmod Prior to Version 3.3.14

CVE-2026-105839

What is CVE-2026-105839?

The libmikmod library, specifically prior to version 3.3.14, suffers from a critical heap buffer overflow due to an integer overflow in the Oktalyzer loader's OKT_doPBOD() function. This flaw allows attackers to craft specially designed OKT modules that manipulate the 16-bit numtrk value within the SLEN chunk. By exploiting this vulnerability, an attacker can execute arbitrary code or crash the application through improper PBOD writes past the allocated track pointers.

References