libmikmod before version 3.3.14 contains an integer overflow in the DSM_Load function that allows attackers to trigger a heap buffer overflow by supplying a specially crafted DSM module. The overflow occurs when the product of the module’s numchn and numpat values wraps a 16‑bit integer, corrupting adjacent heap memory. If the overwrite lands on executable code or control data, the attacker could potentially crash the application or execute arbitrary code. This weakness is a classic integer overflow (CWE‑190).

The affected product is libmikmod, a music module playback library developed by sezero. All installations using libmikmod older than 3.3.14 are vulnerable. Any application that links to libmikmod and accepts user‑supplied DSM files is at risk.

The CVSS score of 8.5 indicates a high severity vulnerability. EPSS information is not available, and the issue is not listed in CISA’s KEV catalog, so the exploitation probability cannot be definitively quantified from the data. The vulnerability can be exploited by an attacker who can supply a crafted DSM module, such as through a malicious file download or by tricking an application to load a tampered module. Because the overflow occurs on the heap, a successful exploit could lead to crashes or arbitrary code execution if the attacker can control the overwritten memory. The risk is amplified in environments where applications dynamically load module files without strict validation.