Out-of-Bounds Read Vulnerability in libmodplug Affects Audio Playback

CVE-2026-75904

What is CVE-2026-75904?

The libmodplug library, specifically versions up to 0.8.9.1, has a vulnerability that allows for an out-of-bounds read when processing MIDI files. This occurs in the pat_smplooped function, where the sample index is validated only against a maximum value. The array access can potentially read memory preceding the array boundary, leading to unexpected behavior during audio playback. If a MIDI event is parsed without an instrument assigned, it initializes with a zero index, triggering the unsafe condition. This flaw can influence how note events are managed, especially when manipulated through crafted MIDI files, which can cause corruption in playback state.

References