Description
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Konstanty Bialkowski | libmodplug | ≤ 0.8.9.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmodplug | No fix yet | — |
| Debian 13 | libmodplug | No fix yet | — |
| Debian 12 | libmodplug | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libmodplug | No fix yet | — |
| Ubuntu 26.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 24.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 22.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 20.04 LTS | libmodplug | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 16.04 LTS | libmodplug | No fix yet | — |
| Ubuntu 14.04 LTS | libmodplug | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gst-plugins-bad0.10 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libmodplug | 0.8.9.0+git20170610.f6dd59a-4.1 | openSUSE-SU-2026:12215-1 |
| openSUSE Leap 16.0 | libmodplug | 0.8.9.0+git20170610.f6dd59a-bp160.2.1 | openSUSE-SU-2026:22165-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libmodplug | No fix yet | — |
Advisories 2
- openSUSE-SU-2026:22165-1 Security update for libmodplug SUSE / openSUSE Security Updates · Oct 24, 2026
- openSUSE-SU-2026:12215-1 libmodplug-devel-0.8.9.0+git20170610.f6dd59a-4.1 on GA media SUSE / openSUSE Security Updates · Oct 22, 2026
References
- https://hackmd.io/@haind-pwn/libmodplug-dsm-pattern-oob-write technical-description
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_ams.cpp#L509-L537 technical-description
- https://github.com/Konstanty/libmodplug product
- VulnCheck Advisory: libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2 third-party-advisory