CVE-2026-105838: Sezero Libmikmod

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.

Affected products

• Sezero Libmikmod: before 3.3.14 (fixed in 3.3.14)

Published 2026-10-06. Last modified 2026-10-06.