CVE-2026-111166
libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a…
Published Oct 15, 2026 · updated Oct 15, 2026
libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file.
Sources
- CVE.orgVulnerability recordCVE-2026-111166
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-111166
libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, ca
nvd.nist.gov