CVE-2026-105839

Name of the Vulnerable Software and Affected Versions libmikmod versions prior to 3.3.14

Description An integer overflow exists in the Oktalyzer loader OKT doPBOD() function. An attacker can exploit this by providing a crafted OKT module where the SLEN chunk wraps the 16-bit numtrk value. This leads to a heap buffer overflow, where PBOD writes occur beyond the allocated track pointers, potentially resulting in application crashes or arbitrary code execution.

Recommendations Update libmikmod to version 3.3.14 or later.