medium · CVSS v3 5.5 · CVSS v4 6.8
CVE-2026-111271
libmodplug 0.8.9.1 contains a heap-based out-of-bounds read in CSoundFile::ReadAMS2() that can be triggered by crafted AMS files. The flaw a
Overview
libmodplug 0.8.9.1 contains a heap-based out-of-bounds read in CSoundFile::ReadAMS2() that can be triggered by crafted AMS files. The flaw allows attackers to read adjacent heap memory and can crash any application that uses libmodplug to decode AMS modules. It affects media players and audio software that rely on libmodplug.
Description
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.
Impact
Confidentiality: potential leakage of sensitive data from adjacent heap memory. Integrity: no direct modification, but crash could lead to denial of service. Availability: application crash. Defenders: administrators of systems running affected media players or embedded audio decoders.
Remediation
Update libmodplug to 0.8.9.2 or later, or update dependent software to patched versions. If update is not possible, disable AMS module support or sandbox the application. Monitor for abnormal crashes and apply security patches promptly.
Risk context
Medium severity (CVSS v3 5.5, v4 6.8) with no EPSS data. The vulnerability requires user interaction to load a crafted AMS file, so the risk is moderate. Defenders should patch promptly to mitigate potential data leakage or denial of service.
Affected products
- Winamp
- VLC
- Audacity
- foobar2000
- MPlayer
- Kodi
- OpenMPT
- Game audio engines
Scores
- Severity
- medium
- CVSS v2
- 4.9
- CVSS v3
- 5.5
- CVSS v4
- 6.8
- EPSS
- —