CVE-2026-105838
libmikmod before 3.3.14 Heap Out-of-Bounds Read via IT Module Loader
sezero libmikmod
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.3.14libmikmodCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.
Text from CVE List
Affected versions 1
- libmikmodaffected: all versions before 3.3.14CVE List
References 5
- github.com/sezero/mikmod/commit/e7c6c9e88fbe3e8af4668a2e116bb8de341383f8Fixvia CVE List
- vulncheck.com/advisories/libmikmod-before-3.3.14-heap-out-of-bounds-read-via-it-module-loaderAdvisoryvia CVE List
- github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_it.c#L198Referencevia CVE List
- github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWSReferencevia CVE List
- github.com/sezero/mikmodReferencevia CVE List