CVE-2026-105839

Summary

A heap buffer overflow vulnerability exists in libmikmod's Oktalyzer loader due to integer overflow when processing crafted track counts in OKT modules, potentially allowing remote code execution or crashes.

Exploitability

Exploitation requires crafting a malicious OKT module with a wrapped 16-bit numtrk value that triggers the integer overflow during PBOD processing, making it moderately difficult but possible to exploit with a crafted input file.

Blast radius

The vulnerability could impact any application using libmikmod for audio module loading, particularly those handling user-uploaded or third-party OKT files, potentially affecting media players, game engines, and audio processing applications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to libmikmod 3.3.14 or later to remediate the integer overflow in OKT_doPBOD().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.