Description
Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier, as used in GStreamer and possibly other products, allow user-assisted remote attackers to execute arbitrary code via (1) long strings in ITP files used by the CSoundFile::ReadITProject function in soundlib/Load_it.cpp and (2) crafted modules used by the CSoundFile::ReadSample function in soundlib/Sndfile.cpp, as demonstrated by crafted AMF files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmodplug | 1:0.7-5.2 | — |
| Debian 13 | libmodplug | 1:0.7-5.2 | — |
| Debian 12 | libmodplug | 1:0.7-5.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | gstreamer-plugins +1 | 0.8.5-1.EL.3 | RHSA-2011:0477 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- OpenMPT 1.17.02.43 - Multiple Remote Buffer Overflows (PoC) EDB-2160 · dos · Aug 10, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2011:0477 Red Hat Security Advisory: gstreamer-plugins security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 21418 third-party-advisory
- openmpt-readsample-bo(28309) vdb-entry
- GLSA-200612-04 vendor-advisory
- 19448 vdb-entry
- USN-521-1 vendor-advisory
- SUSE-SR:2006:023 vendor-advisory
- http://aluigi.altervista.org/adv/mptho-adv.txt
- 22658 third-party-advisory
- 20060809 Stack and heap overflows in MODPlug Tracker/OpenMPT 1.17.02.43 and libmodplug 0.8 mailing-list
- 23555 third-party-advisory
- 22080 third-party-advisory
- ADV-2006-4310 vdb-entry
- http://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/?id=bc2cdd57d549ab3ba59782e9b395d0cd683fd3ac
- MDKSA-2007:001 vendor-advisory
- 1397 third-party-advisory
- 26979 third-party-advisory
- RHSA-2011:0477 vendor-advisory
- 23294 third-party-advisory
- ADV-2006-3231 vdb-entry
- openmpt-loadit-bo(28305) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=497154