CVE-2026-105839: Sezero Libmikmod

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers for crashes or code execution.

Affected products

• Sezero Libmikmod: before 3.3.14 (fixed in 3.3.14)

Published 2026-10-06. Last modified 2026-10-06.