{"schema":"threatline.record/2","record":{"id":"CVE-2026-111270","aliases":[],"summary":"libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM","details":"libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.","categories":["Unclassified"],"product":"libmodplug","vendor":"Konstanty Bialkowski","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111270","source_modified_at":"2026-10-21T01:33:42.918Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"libmodplug","vendor":"Konstanty Bialkowski","versions":[{"version":"0","lessThanOrEqual":"0.8.9.1","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0013,"percentile":0.02359,"score_date":"2026-10-23"},"published_at":"2026-10-15T21:43:17.665Z","modified_at":"2026-10-21T01:33:42.918Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111270","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T01:33:42.918Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111270","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind-pwn/libmodplug-dsm-pattern-oob-write","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_dsm.cpp#L130-L139","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/Konstanty/libmodplug","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/libmodplug-through-0.8.9.1-heap-out-of-bounds-write-via-csoundfile-readdsm","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://hackmd.io/@haind-pwn/cve-2026-111270-111271-libmodplug-dsm-pattern-oob-write","tags":["exploit"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-21T01:33:14.344247Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-21T01:33:42.918Z","content_hash":"6ac3ae74cdfdc0ee2480b01a2d59544fcc93c1b43a5448a88c61d39c541551fb"}}