CVE-2026-75904 Konstanty Bialkowski CVE debrief

Who should care

Defenders responsible for systems or applications using the libmodplug library should assess exposure and verify patched versions. This includes developers and security teams working with multimedia software or systems that process MIDI files.

Why it matters

CVE-2026-75904 is a medium-severity vulnerability in the libmodplug library that can lead to information disclosure or denial of service when processing crafted MIDI files. Defenders should assess exposure, verify patched versions, and restrict the use of untrusted MIDI files.

• Potential for information disclosure due to out-of-bounds memory read.
• Possible denial of service through malformed MIDI file processing.
• Requires verification of patched versions to prevent exploitation.
• Assessment of exposure is necessary for systems using libmodplug.

Technical summary

The libmodplug library through version 0.8.9.1 is vulnerable to an out-of-bounds read in the pat_smplooped function in src/load_pat.cpp. This occurs when the function attempts to index a 191-byte static array with a sample index that has not been properly validated, leading to a potential read of adjacent memory. The vulnerability can be triggered by processing crafted MIDI files, which may result in information disclosure or denial of service. Defenders should verify patched versions and restrict the use of untrusted MIDI files.

Defensive priority

Medium priority for defenders to assess exposure and verify patched versions, given the limited details on affected configurations and potential impact.

Recommended defensive actions

• Assess exposure by checking if the libmodplug library is used in your systems or applications.
• Verify if the patched version of libmodplug (0.8.9.2 or later) is used.
• Review and restrict the use of crafted MIDI files in your applications.
• Consider compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but information on affected versions, exploitation, and impact is limited. The libmodplug library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state. Evidence is based on the CVE description and NVD entry.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.