AdPlug through version 2.4 contains a heap‑based buffer overflow in the CksmPlayer::update() routine. The function writes past a fixed 2048‑byte array without bounds checking, allowing a crafted .ksm module that uses overlapping notes to overwrite adjacent heap memory. This corruption can destroy the player object, leading to application crashes and a denial of service. The weakness is classified as CWE‑787.

The flaw affects the AdPlug Project’s AdPlug media player. All releases up to and including version 2.4 are vulnerable. No other vendors or products are listed as affected.

The advisory lists a CVSS base score of 6.9, indicating a moderate severity level. EPSS scores below 1% suggest a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need the ability to supply a malicious .ksm module—either locally or via a media player that accepts arbitrary modules—to trigger the overflow. Based on the description, it is inferred that there is no publicly documented exploitation evidence, so the primary risk is to systems that process untrusted modules without validation.