CVE-2026-110876
MediumCVSS 5.5Summary
AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows reading before note_table by supplying a negative note index. An attacker can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback.
Risk Assessment
This may lead to application crash or memory disclosure, posing a risk to availability and confidentiality of systems playing untrusted XSM files.
Recommendation
Update AdPlug to a version newer than 2.4 if available, or avoid playing untrusted XSM files until a fix is released.
Other vulnerabilities in AdPlug
See all- CVE-2026-110877Medium
AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp. An attacker can read past a heap allocation by supplying a truncated TwinTeam DMO file (12 or 13 bytes) that passes dmo_unpacker::decrypt() and is opened via CAdPlug::factory.
- CVE-2026-110875Medium
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. An attacker can supply a crafted .ksm module whose notes share one time slot, causing memory corruption and denial of service.
Original NVD description (English source)
AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS