libmikmod: Heap buffer overflow in DSM loader via integer overflow
Summary
libmikmod, a sound library for module music formats, contains an integer overflow in the DSM loader that can lead to a heap buffer overflow. An attacker can cause a crash or possibly code execution by getting a user or application to process a crafted DSM module file. The attack requires local processing of such a file and is not a remotely reachable network service. No exploitation in the wild has been reported.
Affected
- libmikmod before 3.3.14 (CNA record: versions 0 to below 3.3.14)
- SUSE lists SLES 12 and its service pack and extension variants as affected; SLES 12 SP5-LTSS is marked in progress
- Status in other distributions: Unknown
Fixed in
- libmikmod 3.3.14 (upstream)
- Fixed builds in distributions: check your distribution tracker, as versions differ. Unknown for Debian, Ubuntu and RHEL.
Workaround
Unknown. No vendor workaround found.
- Until patched, do not let affected applications open module files from untrusted sources.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- EPSS score 0.00148 (very low).
- No public proof of concept found.
Our recommendation
- Identify hosts and applications that embed libmikmod (for example with dpkg -l or rpm -q libmikmod).
- Install the vendor update or the distribution package that contains the fix, prioritising systems that process untrusted module files.
- Until patched, restrict processing of module files from untrusted sources.
- Monitor for unusual application crashes related to audio or module files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Fix commit a125eabb github.com
- libmikmod 3.3.14 NEWS github.com
- Vulnerable load_dsm.c (3.3.13) github.com
- SUSE CVE page www.suse.com
- Vulners CVE record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:21.
Original description (NVD)
libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.
NVD references (5)
- https://github.com/sezero/mikmod
- https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_dsm.c#L273
- https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS
- https://github.com/sezero/mikmod/commit/a125eabbd086f311496ae46d08aaebcad0a1c426
- https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-buffer-overflow-via-dsm-loader-integer-over…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.