libmikmod: Heap buffer overflow in OKT loader via crafted track count
Summary
libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer (OKT) loader function OKT_doPBOD(). A crafted OKT module whose SLEN chunk wraps the 16-bit track count causes writes past allocated track pointers on the heap. An attacker can use this to crash the application or potentially execute code, provided a victim opens or plays the malicious file in an application that uses libmikmod.
Affected
- sezero libmikmod versions 0 to before 3.3.14
- Distribution packages use their own version numbers; check your vendor's tracker, for example Azure Linux 3 up to 3.3.11.1-14
Fixed in
- Upstream libmikmod 3.3.14 (commit 097b69281fad6ba38a553569e6f55dbfdd71dc2a)
- SUSE: fixed in 3.3.14 (openSUSE-SU-2026:22192-1)
Workaround
- Unknown. No vendor workaround found in the sources.
- Without a patch, do not load untrusted OKT files in applications that use libmikmod.
Exploitation
- Not known to be exploited (SUSE and a second tracker).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS 0.00146 (low).
- Public proof of concept: unknown.
Our recommendation
- Identify systems and applications that ship libmikmod, including bundled copies in games, media tools and legacy software.
- Update libmikmod to 3.3.14 or the vendor-fixed package version.
- Until patched, avoid opening untrusted module files in affected applications.
- Prioritise hosts where users or applications open external module files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-105839 CVELIST record (vulners) vulners.com
- VulnCheck advisory www.vulncheck.com
- libmikmod 3.3.14 NEWS github.com
- Upstream fix commit 097b692 github.com
- SUSE CVE record (vulners) vulners.com
- OSV Azure Linux advisory osv.dev
- SUSE security update (OffSeq radar) radar.offseq.com
- pkgsrc libmikmod pkgsrc.se
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:21.
Original description (NVD)
libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers for crashes or code execution.
NVD references (5)
- https://github.com/sezero/mikmod
- https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_okt.c#L286
- https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS
- https://github.com/sezero/mikmod/commit/097b69281fad6ba38a553569e6f55dbfdd71dc2a
- https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-buffer-overflow-via-okt-loader-okt-dopbod
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.