CVE-2026-75904

Name of the Vulnerable Software and Affected Versions libmodplug versions prior to 0.8.9.2

Description An out-of-bounds read exists in the pat smplooped() function within src/load pat.cpp. The issue occurs because the function only validates the upper bound of the sample index against MAXSMP and subtracts one before indexing the pat loops static array. Consequently, if the smpno variable—which is initialized to zero and may not be overwritten before reaching the note test—is zero, the system reads one byte before the array. This process can be triggered by providing a specially crafted MIDI file to the ModPlug Load entry point, which then passes through CSoundFile::Create, CSoundFile::ReadMID, and MID ReadPatterns. The value read from the out-of-bounds memory determines if a note event is treated as looping, allowing adjacent static storage to influence the playback state.

Recommendations Update libmodplug to version 0.8.9.2 or later.