CVE-2026-111165 in libmikmod
Summary
by MITRE • 10/15/2026
libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in libmikmod versions through 3.3.15 represents a critical memory safety issue within the MultiTracker module loader, specifically located in the MTM_Load function. This flaw is classified as an out-of-bounds read, which corresponds to CWE-126 (Buffer Over-read). The root cause of this vulnerability lies in the failure to validate and clamp the channel count specified in the header of a crafted .mtm file before it is used to access internal data structures. In standard MultiTracker module formats, there is typically an expectation that the number of channels will fall within a predefined range, often capped at thirty-two for historical compatibility reasons with early sound hardware limitations. However, libmikmod does not enforce this boundary check during the loading process, allowing arbitrary values provided by the attacker to dictate memory access patterns.
When an application utilizing libmikmod processes a maliciously crafted .mtm file containing a channel count exceeding thirty-two, the library attempts to allocate or reference track indices based on this unvalidated number. Because the internal static pat array and associated tracking structures are sized for a maximum of thirty-two channels, accessing elements beyond this limit results in reading memory locations that lie outside the intended buffer boundaries. This out-of-bounds read does not necessarily lead to immediate code execution but causes significant data corruption within the application's state machine. The track indices become corrupted as they reference invalid or unrelated memory regions, leading to unpredictable behavior during playback initialization.
The operational impact of this vulnerability is primarily denial of service through application crashes. Since the MTM_Load function is a core component responsible for initializing audio modules, triggering this flaw causes the host application to terminate abruptly when it encounters illegal memory access errors such as segmentation faults. While out-of-bounds reads are sometimes leveraged in sophisticated attacks to leak sensitive information from adjacent memory regions, in the context of an audio library processing untrusted media files, the most immediate and prevalent consequence is stability failure. Attackers can exploit this by distributing malicious .mtm files via email attachments, web downloads, or embedded content within other multimedia containers that support module formats, thereby causing crashes for any user attempting to open these files with a vulnerable version of libmikmod.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1496 (Resource Hijacking) in the context of denial-of-service impacts on system resources, although it is more accurately described as an exploitation vector for stability disruption rather than resource consumption attacks like crypto-mining. The lack of input validation reflects a common pattern in legacy multimedia libraries where performance optimizations or assumptions about file format compliance override rigorous security checks. This specific flaw highlights the risks associated with processing untrusted binary data without strict adherence to expected structural constraints defined by the file specification.
Mitigation strategies for this vulnerability involve upgrading libmikmod to version 3.3.16 or later, where developers have implemented proper bounds checking and clamping of channel counts before array access occurs. For organizations unable to upgrade immediately due to dependency constraints, implementing a sandboxed environment for processing untrusted audio files can reduce the blast radius of potential crashes. Additionally, input validation at the application layer that rejects module headers with channel counts exceeding standard limits serves as an effective defense-in-depth measure. Security teams should also audit other loaders within libmikmod for similar patterns where user-supplied metadata dictates memory layout without adequate verification against static buffer sizes to prevent recurrence of out-of-bounds access issues across different file formats supported by the library.