{"id":"CVE-2026-105837","published":"2026-10-06T14:17:40.763","lastModified":"2026-10-06T20:17:16.590","description":"libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-190"],"vendors":[],"products":[],"references":[{"url":"https://github.com/sezero/mikmod","tags":[]},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_dsm.c#L273","tags":[]},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS","tags":[]},{"url":"https://github.com/sezero/mikmod/commit/a125eabbd086f311496ae46d08aaebcad0a1c426","tags":[]},{"url":"https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-buffer-overflow-via-dsm-loader-integer-overflow","tags":[]}],"exploitRefs":[{"url":"https://github.com/sezero/mikmod","tags":[]},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_dsm.c#L273","tags":[]},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS","tags":[]},{"url":"https://github.com/sezero/mikmod/commit/a125eabbd086f311496ae46d08aaebcad0a1c426","tags":[]}],"hasPoc":true,"ai":{"summary":"A heap buffer overflow vulnerability exists in libmikmod before version 3.3.14, where crafted track counts in DSM modules can cause integer overflow leading to memory corruption. This allows attackers to potentially crash systems or execute arbitrary code.","exploitability":"Exploitation is moderately difficult as it requires crafting a specific DSM module with carefully calculated numchn and numpat values that wrap a 16-bit value, but the vulnerability is remotely triggerable through file processing.","blast_radius":"The impact could be significant in environments where users can upload or process DSM audio files, potentially leading to widespread system crashes or code execution across multiple affected applications using libmikmod.","remediation":"Upgrade to libmikmod version 3.3.14 or later to remediate this integer overflow vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["audio","heap-overflow","integer-overflow","rce"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:01:49.992Z"}}