CVE-2026-75904
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index and then subtracts one before indexing the pat_loops array, allowing a read of one byte before the array when the index is zero.
Risk Assessment
Out-of-bounds read may lead to unexpected MIDI playback behavior, and in extreme cases, data disclosure or application crash.
Recommendation
Update libmodplug to a patched version or avoid processing untrusted MIDI files.
Related vulnerabilities
- CVE-2026-106102Critical
Quasar Framework before 2.22.0 has a vulnerability in the SSR-only getHead() serializer that fails to properly encode values supplied via useMeta(). An attacker who can influence dynamic page metadata can inject executable HTML markup before hydration. The client-side path is not affected because it uses DOM APIs that encode attributes.
- CVE-2026-105863Critical
Payload CMS in versions after 3.0.0 and before 3.90.0 allows a custom field option that maps a field to a reserved authentication claim name to place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
- CVE-2026-105859Critical
Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to modify collection documents without enforcing collection or field-level access control when orderable is enabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105857Critical
The @payloadcms/plugin-form-builder plugin in versions before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to execute code remotely on the server via a crafted form submission. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105851Critical
Payload CMS in versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability in the duplicate operation that copies values from a source document even when a field is hidden or its access.read/access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-104070Critical
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.
- CVE-2026-67273Critical
Dell Container Storage Modules before version 1.18.0 contain an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.
- CVE-2026-105845Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an untrusted user who can query readable collections through dynamic filters or joins to submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-105844Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an unauthenticated user to submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-67269Critical
Dell Container Storage Modules (CSM) Operator prior to version 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this vulnerability to escalate privileges and gain root-level access on cluster nodes.
Original NVD description (English source)
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS