CVE-2026-105837highCWE-190

CVE-2026-105837: fallo de gravedad alta en sezero libmikmod

libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow

Publicada el

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.5epss 0.1%
probabilidad de explotación
0.1%top 96% de las CVE
explotación observada
noninguna fuente lo reporta
libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
sezero · libmikmod
CVEs relacionadas — sezero libmikmod

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-105839HIGHlibmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBODEPSS 0.1%CVE-2026-105838MEDIUMlibmikmod before 3.3.14 Heap Out-of-Bounds Read via IT Module LoaderEPSS 0.1%
Referencias
https://github.com/sezero/mikmodhttps://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_dsm.c#L273https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWShttps://github.com/sezero/mikmod/commit/a125eabbd086f311496ae46d08aaebcad0a1c426https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-buffer-overflow-via-dsm-loader-integer-overflow