libmikmod versions before 3.3.14 contain an integer overflow in the Oktalyzer loader function that processes the OKT format. The overflow occurs when the parser reads the 16‑bit track count value from the SLEN chunk and uses it to determine how many PBOD structures to allocate. If an attacker supplies a module where this value wraps around, the resulting index becomes larger than the allocated array, leading to a heap buffer overflow. The vulnerability can be leveraged to corrupt memory, crash the application, or potentially execute arbitrary code if an attacker controls the overwritten pointers. The flaw is categorized as CWE‑190: Integer Overflow or Wraparound.

The affected product is libmikmod distributed by sezero. Versions prior to 3.3.14 are vulnerable; no specific sub‑version range beyond that is identified in the CNA data. An attacker who can supply a malicious OKT module to a process running libmikmod is able to trigger the vulnerability.

The CVSS score of 8.5 indicates high severity. EPSS data is not available, so the exploitation likelihood cannot be quantified, and KEV does not list this issue. The vulnerability can be triggered by providing a crafted OKT module file, which is a practical attack vector in any environment where libmikmod processes user supplied media files. Rows of unsupported tracks that wrap the 16‑bit counter create the overflow, making the weakness exploitable where the library is used to load media. The risk is elevated if libmikmod is used in a privileged context or exposed to untrusted input.