EUVD-2026-102525

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

CVE-2026-111270

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

CVE-2026-111270

The libmodplug library (versions through 0.8.9.1 ) is vulnerable to a heap-based out-of-bounds write within the CSoundFile::ReadDSM() function in src/load_dsm.cpp. The root cause is a failure to validate that the variable nPat is checked against MAX_PATTERNS. An attacker can exploit this by provi...

CVE-2026-111270 libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

PT-2026-115262

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/load dsm.cpp because nPat is never checked against MAX PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt len value to corrupt heap memory and crash the...

CVE-2011-2914

CVE-2011-2914 affects libmodplug’s DSM file handling: Off-by-one in CSoundFile::ReadDSM (src/load_dms.cpp) before 0.8.8.4 may allow a remote attacker to cause memory corruption, leading to denial of service and potential arbitrary code execution via crafted DSM files with many samples. Public rep...

CVE-2011-2914: Undefined Security Weakness

Off-by-one error in the CSoundFile::ReadDSM function in src/loaddms.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary code via a crafted DSM file with a large number of samples...