openSUSE-SU-2026:22165-1
openSUSE-SU-2026:22165-1 · Security update for libmodplug
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for libmodplug fixes the following issues: Changes in libmodplug: - CVE-2026-108577: This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption [bsc#1284977] - CVE-2026-111270: a heap-based out-of-bounds write in CSoundFile:ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS [bsc#1285765] - CVE-2026-111271: a heap-based out-of-bounds read vulnerability in CSoundFile:ReadAMS2() in src/load_ams.cpp [bsc#1285766] - CVE-2026-75904: libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp [bsc#1275624]
Fix available
- Published
- Updated
Stack: system
Affected products and versions
libmodplug openSUSE:Leap 16.0
- Affected ranges
- ECOSYSTEM: < 0.8.9.0+git20170610.f6dd59a-bp160.2.1
Update to 0.8.9.0+git20170610.f6dd59a-bp160.2.1
Original sources
- https://bugzilla.suse.com/1275624
- https://bugzilla.suse.com/1284977
- https://bugzilla.suse.com/1285765
- https://bugzilla.suse.com/1285766
- https://www.suse.com/security/cve/CVE-2026-108577
- https://www.suse.com/security/cve/CVE-2026-111270
- https://www.suse.com/security/cve/CVE-2026-111271
- https://www.suse.com/security/cve/CVE-2026-75904
- https://osv.dev/vulnerability/openSUSE-SU-2026:22165-1