CVE-2026-110875

Name of the Vulnerable Software and Affected Versions AdPlug versions prior to 2.5

Description A heap-based buffer overflow occurs in the CksmPlayer::update() function within src/ksm.cpp. The issue arises because the software writes past the fixed databuf[2048] array without performing bounds checking. An attacker can exploit this by providing a specially crafted .ksm module where notes share a single time slot, leading to memory corruption of the heap player object and resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.