CVE-2026-110875 in AdPlug
Summary
by MITRE • 10/15/2026
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
AdPlug version 2.4 contains a critical heap-based buffer overflow vulnerability located within the CksmPlayer::update() function in the src/ksm.cpp source file. This flaw arises from an absence of proper bounds checking when processing audio module data, specifically affecting the fixed-size databuf array which is allocated with a capacity of two thousand and forty-eight bytes. The underlying technical defect allows for out-of-bounds writes that extend beyond the boundaries of this pre-allocated buffer into adjacent heap memory regions. This type of vulnerability is classically categorized under CWE-122, Heap-based Buffer Overflow, where data written to a buffer exceeds its allocated size on the heap rather than the stack, leading to potential exploitation scenarios involving arbitrary code execution or severe system instability depending on the specific memory layout and allocator behavior at runtime.
The operational impact of this vulnerability is primarily observed through denial of service conditions caused by memory corruption when an attacker supplies a maliciously crafted .ksm module file. The exploit mechanism relies on manipulating the metadata within the audio module such that multiple notes are scheduled to share a single time slot during playback processing. This specific condition triggers the overflow in the update loop, causing data to be written past the end of the databuf array and corrupting adjacent heap objects or control structures associated with the player instance. Such memory corruption can lead to application crashes, segmentation faults, or potentially allow for remote code execution if an attacker can carefully craft the payload to overwrite function pointers or other critical metadata within the heap structure.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1203, Exploitation for Client Execution, as it involves tricking a user into opening a malicious file that triggers code execution logic during normal playback operations. It also relates to CWE-787, Out-of-bounds Write, which describes the fundamental error of writing data beyond the allocated memory boundary. The vulnerability highlights the risks associated with parsing untrusted input formats in multimedia libraries where performance optimizations often bypass rigorous validation checks. Attackers can leverage this flaw by distributing malicious .ksm files through various vectors such as email attachments, compromised websites, or peer-to-peer networks to induce victims to open the file within an application utilizing AdPlug.
Mitigation strategies for this vulnerability require immediate patching of the affected software version to include proper bounds checking logic within the CksmPlayer::update() function. Developers must ensure that all array accesses are validated against the maximum size of the databuf buffer before writing data, thereby preventing any out-of-bounds writes regardless of how many notes share a time slot. Additionally, input validation should be implemented at the module parsing stage to detect and reject malformed or suspiciously structured audio files before they reach the playback engine. Organizations relying on AdPlug for multimedia applications should update their dependencies to version 2.5 or later where this issue has been addressed. Security teams should also monitor for indicators of compromise related to unusual memory allocation patterns or crashes in applications using vulnerable versions of the library, and consider implementing sandboxing techniques to limit the impact of potential exploitation attempts until patches are deployed.