Heap Out-of-Bounds Read Vulnerability in libmikmod by Sezero
CVE-2026-111166

6.8MEDIUM

Key Information:

Vendor

Sezero

Status
LIBMikmod
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111166?

The libmikmod library, up to version 3.3.15, is susceptible to a heap out-of-bounds read vulnerability within the IMF_Load() function. This occurs when a crafted IMF module is supplied, enabling attackers to exploit the linear-period header flag, leading to the mapping of notes to samples that exceed allocated memory bounds. This flaw facilitates improper note index access, potentially causing crashes in applications that utilize the library to load IMF files, thereby compromising system stability and functionality.

Affected Version(s)

libmikmod 0 <= 3.3.15

References

https://hackmd.io/@haind-pwn/libmikmod-mtm-imf-loader-oob...
technical-description
https://github.com/sezero/mikmod/blob/6e658155f7e6b394a28...
technical-description
https://github.com/sezero/mikmod
product

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.