CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.

• CWE-125

• https://github.com/Konstanty/libmodplug
• https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_mid.cpp#L829
• https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_pat.cpp#L213-L217
• https://github.com/Konstanty/libmodplug/issues/103
• https://www.vulncheck.com/advisories/libmodplug-out-of-bounds-read-in-pat-smplooped-via-crafted-midi-file
• https://github.com/Konstanty/libmodplug/issues/103

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75896Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGE…9.1
• CVE-2026-75897Improper input validation in the capabilities route handler …7.5
• CVE-2026-75898RAGFlow before 0.26.3 contains a server-side request forgery…8.5
• CVE-2026-75899fast-uri is a URI parser for Node.js. It decodes percent esc…7.5
• CVE-2026-7590A vulnerability was identified in eyal-gor p_69_branch_monke…7.3
• CVE-2026-75900An out-of-bounds read vulnerability was found in swtpm's SWT…6.1
• CVE-2026-75905The WP Recipe Maker plugin for WordPress is vulnerable to au…4.3
• CVE-2026-75908The Newsletters plugin for WordPress is vulnerable to author…4.3
• CVE-2026-7591A security flaw has been discovered in TimBroddin astro-mcp-…6.3
• CVE-2026-75910Incorrect privilege assignment in the ClickHouse connector d…6.5
• CVE-2026-75911CodeWhale versions before 0.8.64 fail to properly validate t…7.8
• CVE-2026-75912CodeWhale versions before 0.8.64 contain an argument injecti…7.4