Description
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Konstanty Bialkowski | libmodplug | ≤ 0.8.9.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmodplug | No fix yet | — |
| Debian 13 | libmodplug | No fix yet | — |
| Debian 12 | libmodplug | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libmodplug | No fix yet | — |
| Ubuntu 26.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 24.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 22.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 20.04 LTS | libmodplug | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 16.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 14.04 LTS | libmodplug | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gst-plugins-bad0.10 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libmodplug | 0.8.9.0+git20170610.f6dd59a-4.1 | openSUSE-SU-2026:12215-1 |
| openSUSE Leap 16.0 | libmodplug | 0.8.9.0+git20170610.f6dd59a-bp160.2.1 | openSUSE-SU-2026:22165-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libmodplug | No fix yet | — |
Advisories 2
- openSUSE-SU-2026:22165-1 Security update for libmodplug SUSE / openSUSE Security Updates · Oct 24, 2026
- openSUSE-SU-2026:12215-1 libmodplug-devel-0.8.9.0+git20170610.f6dd59a-4.1 on GA media SUSE / openSUSE Security Updates · Oct 22, 2026
References
- https://hackmd.io/@haind-pwn/libmodplug-dsm-pattern-oob-write technical-description
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_dsm.cpp#L130-L139 technical-description
- https://github.com/Konstanty/libmodplug product
- VulnCheck Advisory: libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM third-party-advisory