Heap-Based Buffer Overflow in AdPlug by AdPlug

CVE-2026-110875

What is CVE-2026-110875?

AdPlug versions up to 2.4 are susceptible to a heap-based buffer overflow due to improper bounds checking in the CksmPlayer::update() function within src/ksm.cpp. Attackers can exploit this vulnerability by supplying a specially crafted .ksm module where multiple notes share the same time slot. This manipulation allows them to overflow the heap memory allocated for the player object, leading to potential memory corruption and denial of service. It is crucial for users and administrators to apply the necessary patches and updates to mitigate associated risks.

References