Description
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or disrupt loading.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libxmp | libxmp | ≤ 4.7.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxmp | No fix yet | — |
| Debian 13 | libxmp | No fix yet | — |
| Debian 12 | libxmp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libxmp | No fix yet | — |
| Ubuntu 26.04 LTS | libxmp | No fix yet | — |
| Ubuntu 24.04 LTS | libxmp | No fix yet | — |
| Ubuntu 22.04 LTS | libxmp | No fix yet | — |
| Ubuntu 20.04 LTS | libxmp | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libxmp | No fix yet | — |
| Ubuntu 16.04 LTS | libxmp | No fix yet | — |
References
- https://hackmd.io/@haind-pwn/libxmp-p61a-sample-backreference-oob-read technical-description
- https://github.com/libxmp/libxmp/blob/5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da/src/loaders/prowizard/p61a.c#L110-L116 technical-description
- https://github.com/libxmp/libxmp/blob/5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da/src/loaders/prowizard/p61a.c#L638-L641 technical-description
- https://github.com/libxmp/libxmp product
- VulnCheck Advisory: libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker third-party-advisory