Description
Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro functions in src/load_abc.cpp in libmodplug before 0.8.8.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ABC file. NOTE: some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmodplug | 1:0.8.8.4-1 | — |
| Debian 13 | libmodplug | 1:0.8.8.4-1 | — |
| Debian 12 | libmodplug | 1:0.8.8.4-1 | — |
| Debian 6.0 | libmodplug | 1:0.8.8.1-1+squeeze2 | DSA-2415-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Libmodplug 0.8.8.2 - '.abc' Stack Buffer Overflow (PoC) EDB-17222 · dos · Apr 28, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-2415-1 libmodplug - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2415 vendor-advisory
- 44870 third-party-advisory
- 72157 vdb-entry
- USN-1148-1 vendor-advisory
- 44695 third-party-advisory
- 48058 third-party-advisory
- 17222 exploit
- 45742 third-party-advisory
- openSUSE-SU-2011:0943 vendor-advisory
- [oss-security] 20120502 Re: CVE request: libmodplugin stack-buffer overflow mailing-list
- [oss-security] 20120502 CVE request: libmodplugin stack-buffer overflow mailing-list
- 44388 third-party-advisory
- openSUSE-SU-2011:0551 vendor-advisory