CVE-2026-110875
MediumCVSS 6.1Summary
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. An attacker can supply a crafted .ksm module whose notes share one time slot, causing memory corruption and denial of service.
Risk Assessment
This may lead to memory corruption and application crash, posing a risk to availability of systems processing untrusted .ksm files.
Recommendation
Update AdPlug to a version newer than 2.4 if available, or avoid opening untrusted .ksm files until a fix is released.
Other vulnerabilities in AdPlug
See all- CVE-2026-110877Medium
AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp. An attacker can read past a heap allocation by supplying a truncated TwinTeam DMO file (12 or 13 bytes) that passes dmo_unpacker::decrypt() and is opened via CAdPlug::factory.
- CVE-2026-110876Medium
AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows reading before note_table by supplying a negative note index. An attacker can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback.
Original NVD description (English source)
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS