CVE-2026-105838

Medium

Description

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.

SeverityMedium

CVSS5.5

Exploit probability—

ProductSezero Libmikmod

PublishedOct 6, 2026

First seenOct 6, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Update

sezero libmikmod3.3.14 or later

Patches

github.com/sezero/mikmod/commit/e7c6c9e88fbe3e8af4668a2e116bb8de341383f8

Vendor advisories

github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS

Affected products

Product	Affected versions	Fixed in
sezero libmikmod	v < 3.3.14	3.3.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.