| Titre | Konstanty（Konstanty Bialkowski， github.com/Konstanty/libmod） libmodplug 0.8.9.0 CWE-400 Uncontrolled Resource Consumption |
|---|
| Description | libmodplug x.x.x.x (including the x.x.x.x development version) contains a resource
consumption vulnerability (CWE-400) in its ABC music format parsing component.
The issue resides in the abc_add_gchord() function in src/load_abc.cpp: the loop
termination time stime for chord event generation is derived from attacker-controlled
input parameters (line 3219, stime = (tracktime - etime) * steps) with no upper bound
imposed. On each iteration of the while(rtime < stime) loop at line 3221, an ABCEVENT
structure is allocated via abc_add_chordnote()/abc_add_noteoff() -> abc_new_event() ->
calloc, with no limit on the total number of allocations and no deallocation within
the loop.
An attacker can craft a malicious ABC file (minimal PoC: only 463 bytes). When an
application loads this file through the public API ModPlug_Load(), process memory
grows unboundedly at approximately 860 MB/s (measured: 3.8 MB to 10.3 GB within
12 seconds), eventually exhausting memory, terminating the process, or depleting host
resources — resulting in a denial of service. The ABC format is identified by file
content rather than file extension. Exploitation requires only that a user or an
automated processing pipeline opens the malicious file; no authentication or special
privileges are needed.
Call chain: ModPlug_Load -> CSoundFile::Create -> CSoundFile::ReadABC ->
abc_add_gchord -> abc_add_chordnote/abc_add_noteoff -> abc_new_event -> calloc.
Any application that integrates libmodplug and processes untrusted audio files is
affected. |
|---|
| La source | ⚠️ https://sourceforge.net/projects/modplug-xmms/files/libmodplug/x.x.x.x/ |
|---|
| Utilisateur | jenseny20 (UID 100950) |
|---|
| Soumission | 02/09/2026 05:26 (il y a 1 mois) |
|---|
| Modérer | 10/10/2026 17:49 (1 month later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 416234 [Konstanty Bialkowski libmodplug jusqu’à 0.8.9.1 ABC Music Format Parser src/load_abc.cpp abc_add_gchord déni de service] |
|---|
| Points | 20 |
|---|