libmodplug vulnerabilities
CVEs whose affected-version data names the libmodplug package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-111271Medium· 5.5libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module …
CVE-2026-111270Medium· 6.1libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a …
CVE-2026-108577Medium· 4.3A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource cons…
CVE-2026-75904Low· 3.3PoClibmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static arr…