CVE-2026-75904 Overview
CVE-2026-75904 is an out-of-bounds read vulnerability in libmodplug through version 0.8.9.1. The flaw resides in the pat_smplooped function in src/load_pat.cpp, where the code validates only the upper bound of a sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops. When the index is zero, the function reads pat_loops[-1], one byte before the array. A crafted 32-byte MIDI file passed to the library's public ModPlug_Load entry point drives execution through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the vulnerable read. [CWE-125]
Critical Impact
A maliciously crafted MIDI file processed by applications linked to libmodplug triggers an out-of-bounds read whose value influences playback state, exposing adjacent static memory contents to attacker-controlled logic.
Affected Products
- libmodplug through 0.8.9.1
- Applications and media players that link against libmodplug for MIDI/MOD playback
- Downstream Linux distributions packaging the affected library
Discovery Timeline
- 2026-08-18 - CVE-2026-75904 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75904
Vulnerability Analysis
The vulnerability is an out-of-bounds read in the pat_smplooped routine of libmodplug. The function receives a sample index (smpno) sourced from a parsed MIDI event and checks only that the index does not exceed MAXSMP. It then decrements the index by one before using it to access the 191-byte static array pat_loops. When smpno is zero, the decrement produces -1, and the code reads a byte located immediately before pat_loops in static storage.
The smpno field is initialized to zero for each MIDI event and is only overwritten later when a program-change parameter is processed. Any event that reaches the note test before an instrument has been assigned still carries the initial zero, triggering the underflow. The byte read out of bounds determines whether the note event is treated as looping, so adjacent static memory contents directly influence playback state.
Root Cause
The defect stems from missing lower-bound validation. The code enforces smpno <= MAXSMP but does not enforce smpno > 0 before performing pat_loops[smpno - 1]. Combined with the default-zero initialization of smpno in the MIDI event parser, an event dispatched before program-change assignment produces a signed underflow into the array index. See the libmodplug source at load_pat.cpp lines 213-217 and the call site in load_mid.cpp.
Attack Vector
An attacker crafts a MIDI file as small as 32 bytes and delivers it to any application that calls ModPlug_Load. Exploitation requires user interaction to open or play the file. The read is confined to memory adjacent to pat_loops, so the impact is limited to influencing playback state and potentially leaking small amounts of adjacent static data through side-channel behavior. Additional context is available in the VulnCheck advisory and GitHub Issue #103.
Detection Methods for CVE-2026-75904
Indicators of Compromise
- Unusually small MIDI files (~32 bytes) processed by applications linking libmodplug.
- Crashes, abnormal audio behavior, or memory sanitizer reports originating from pat_smplooped, MID_ReadPatterns, or CSoundFile::ReadMID.
- MIDI files delivered via untrusted channels such as email attachments, downloads, or web content that target media playback stacks.
Detection Strategies
- Scan build manifests and package inventories for libmodplug versions at or below 0.8.9.1.
- Run affected binaries under AddressSanitizer or Valgrind against untrusted MIDI corpora to surface the out-of-bounds read at load_pat.cpp:213-217.
- Fuzz ModPlug_Load with structure-aware MIDI generators to reproduce zero-smpno events prior to program-change assignment.
Monitoring Recommendations
- Track process crashes in media players, converters, and games that embed libmodplug, especially SIGSEGV events tied to MIDI parsing.
- Alert on file-type mismatches where MIDI content is routed to applications with a history of unsafe parsing.
- Monitor software composition analysis (SCA) outputs for libmodplug across container images and third-party bundles.
How to Mitigate CVE-2026-75904
Immediate Actions Required
- Inventory all applications, packages, and container images that link against libmodplug 0.8.9.1 or earlier.
- Restrict processing of MIDI files from untrusted sources until a fixed build is deployed.
- Rebuild dependent software after applying a patched libmodplug from the upstream Konstanty/libmodplug repository.
Patch Information
At publication, no vendor-released fixed version is listed in the NVD entry. Track the upstream repository and Issue #103 for a patch that adds a lower-bound check on smpno before indexing pat_loops. Downstream distributions typically follow with backported updates. Consult the VulnCheck advisory for remediation status.
Workarounds
- Disable MIDI playback in applications where it is not required.
- Block or quarantine MIDI files at the email gateway and web proxy when they originate from untrusted senders.
- Sandbox media playback processes to contain any secondary effects from memory disclosure.
- Apply a local source patch that rejects events with smpno == 0 before the pat_loops[smpno - 1] access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
