{"id":"CVE-2026-105839","published":"2026-10-06T14:17:41.133","lastModified":"2026-10-06T17:17:19.783","description":"libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers for crashes or code execution.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-190"],"vendors":[],"products":[],"references":[{"url":"https://github.com/sezero/mikmod","tags":[]},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_okt.c#L286","tags":[]},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS","tags":[]},{"url":"https://github.com/sezero/mikmod/commit/097b69281fad6ba38a553569e6f55dbfdd71dc2a","tags":[]},{"url":"https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-buffer-overflow-via-okt-loader-okt-dopbod","tags":[]}],"exploitRefs":[{"url":"https://github.com/sezero/mikmod","tags":[]},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_okt.c#L286","tags":[]},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS","tags":[]},{"url":"https://github.com/sezero/mikmod/commit/097b69281fad6ba38a553569e6f55dbfdd71dc2a","tags":[]}],"hasPoc":true,"ai":{"summary":"A heap buffer overflow vulnerability exists in libmikmod's Oktalyzer loader due to integer overflow when processing crafted track counts in OKT modules, potentially allowing remote code execution or crashes.","exploitability":"Exploitation requires crafting a malicious OKT module with a wrapped 16-bit numtrk value that triggers the integer overflow during PBOD processing, making it moderately difficult but possible to exploit with a crafted input file.","blast_radius":"The vulnerability could impact any application using libmikmod for audio module loading, particularly those handling user-uploaded or third-party OKT files, potentially affecting media players, game engines, and audio processing applications.","remediation":"Upgrade to libmikmod 3.3.14 or later to remediate the integer overflow in OKT_doPBOD().","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","audio","buffer-overflow","file-upload"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:01:39.604Z"}}