CVE-2026-105837: Sezero Libmikmod

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.

Affected products

• Sezero Libmikmod: before 3.3.14 (fixed in 3.3.14)

Published 2026-10-06. Last modified 2026-10-06.