AdPlug up to version 2.4 contains an out‑of‑bounds read in src/xsm.cpp that is triggered when the program receives a negative note index. The vulnerability allows an attacker to read beyond the note table into adjacent memory, resulting in a global‑buffer‑overflow read during playback that can crash the application and potentially expose sensitive data.

All installations of AdPlug through 2.4 that process XSM files are affected. This includes any system or application that uses AdPlug to play XSM music data, regardless of the operating system.

The CVSS score of 6.8 indicates moderate severity, while an EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted XSM file containing a negative note index, so the attack vector is file‑based. The impact is primarily a denial of service or accidental information disclosure, rather than remote code execution.