{"id":"openSUSE-SU-2026:22165-1","summary":"Security update for libmodplug","details":"This update for libmodplug fixes the following issues:\n\nChanges in libmodplug:\n\n- CVE-2026-108577: This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption [bsc#1284977]\n- CVE-2026-111270: a heap-based out-of-bounds write in CSoundFile:ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS [bsc#1285765]\n- CVE-2026-111271: a heap-based out-of-bounds read vulnerability in CSoundFile:ReadAMS2() in src/load_ams.cpp [bsc#1285766]\n- CVE-2026-75904: libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp [bsc#1275624]\n","modified":"2026-10-24T16:45:03.941990739Z","published":"2026-10-23T20:13:09Z","related":["CVE-2026-108577","CVE-2026-111270","CVE-2026-111271","CVE-2026-75904"],"upstream":["CVE-2026-108577","CVE-2026-111270","CVE-2026-111271","CVE-2026-75904"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275624"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284977"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285765"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285766"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-108577"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-111270"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-111271"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-75904"}],"affected":[{"package":{"name":"libmodplug","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/libmodplug&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.9.0+git20170610.f6dd59a-bp160.2.1"}]}],"ecosystem_specific":{"binaries":[{"libmodplug-devel":"0.8.9.0+git20170610.f6dd59a-bp160.2.1","libmodplug1":"0.8.9.0+git20170610.f6dd59a-bp160.2.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22165-1.json"}}],"schema_version":"1.9.0"}