p PatchFirst

CVE-2026-105837

CVE-2026-105837 · libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.

CVSS 8.5 · High · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libmikmod

    Versions
    • ≥ 0, < 3.3.14: Affected (semver)

    Update to 3.3.14

  • libmikmod Debian:12

    Versions
    • 3.3.11.1-7
    • 3.3.11.1-8
    • 3.3.12-1
    • 3.3.13-1
    • 3.3.14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libmikmod Debian:13

    Versions
    • 3.3.13-1
    • 3.3.14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libmikmod Debian:14

    Versions
    • 3.3.13-1
    Affected ranges
    • ECOSYSTEM: < 3.3.14-1

    Update to 3.3.14-1

  • libmikmod Ubuntu:16.04:LTS

    Versions
    • 3.3.7-1
    • 3.3.8-1
    • 3.3.8-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • timidity Ubuntu:16.04:LTS

    Versions
    • 2.13.2-40.2build1
    • 2.13.2-40.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libmikmod Ubuntu:18.04:LTS

    Versions
    • 3.3.11.1-1
    • 3.3.11.1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • timidity Ubuntu:18.04:LTS

    Versions
    • 2.13.2-40.5
    • 2.13.2-41
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libmikmod Ubuntu:20.04:LTS

    Versions
    • 3.3.11.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • timidity Ubuntu:20.04:LTS

    Versions
    • 2.14.0-8build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libmikmod Ubuntu:22.04:LTS

    Versions
    • 3.3.11.1-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • timidity Ubuntu:22.04:LTS

    Versions
    • 2.14.0-8build1
    • 2.14.0-8ubuntu1
    • 2.14.0-8ubuntu1.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libmikmod Ubuntu:24.04:LTS

    Versions
    • 3.3.11.1-7
    • 3.3.11.1-7build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • timidity Ubuntu:24.04:LTS

    Versions
    • 2.14.0-8.1ubuntu1
    • 2.14.0-8.1ubuntu4
    • 2.14.0-8.2ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libmikmod Ubuntu:26.10

    Versions
    • 3.3.13-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • timidity Ubuntu:26.10

    Versions
    • 2.14.0-8.3ubuntu1
    • 2.14.0-8.4ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libmikmod Ubuntu:26.04:LTS

    Versions
    • 3.3.13-1
    • 3.3.13-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • timidity Ubuntu:26.04:LTS

    Versions
    • 2.14.0-8.3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →