Konstanty Bialkowski CVE debriefs

CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. This occurs when processing MIDI files, which can lead to information disclosure or denia [truncated]