CVE-2026-111271 — libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memor…
Published: 2026-10-15 · CVSS: 6.8 · CVSS 4.0
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7