---
id: CVE-2026-111131
title: >-
  libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read
  vulnerability in the prowizard P61A depacker depack_p61a() in
  src/loaders/prowizard/p61a.c
summary: >-
  libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read
  vulnerability in the prowizard P61A depacker depack_p61a() in
  src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A
  module with 31 samples and a …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cwe:
  - CWE-125
vendor: libxmp
product: libxmp
affected:
  - libxmp <= 4.7.4
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:26.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111131'
references:
  - url: 'https://github.com/libxmp/libxmp'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/libxmp/libxmp/blob/5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da/src/loaders/prowizard/p61a.c#L110-L116
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/libxmp/libxmp/blob/5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da/src/loaders/prowizard/p61a.c#L638-L641
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind-pwn/libxmp-p61a-sample-backreference-oob-read'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/libxmp-through-4.7.4-stack-out-of-bounds-read-via-p61a-depacker
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
ingestedAt: '2026-10-15T19:25:46.408Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T19:48:49.361100Z'
---

## Overview

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or disrupt loading.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.