A heap out‑of‑bounds read occurs in the Impulse Tracker module loader when handling IT format files that contain more than 200 pattern rows. The vulnerability is triggered by a crafted file that causes the loader to read beyond the intended buffer, exposing adjacent heap content. The read can be used to obtain sensitive data from memory, and a buffer overrun condition also leads to application crashes, disrupting services that rely on the library.

The vulnerability affects the libmikmod library distributed by sezero. All releases prior to 3.3.14, including 3.3.13 and earlier versions, are impacted.

The CVSS score of 6.8 indicates a medium severity. Exploitation requires an attacker to supply a malicious IT module to a vulnerable system using the library. The attack vector is application‑level file input, which can be leveraged by users with the ability to load or influence module files. While the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting that no active exploitation cases have been observed yet. Nonetheless, the potential for memory disclosure and denial of service warrants timely mitigation.