Description
AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.
Published: 2026-10-15
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data leakage and crash
Action: Patch
AI Analysis

Impact

The vulnerability exists in the CdmoLoader::load function of AdPlug 2.4, whereby a truncated TwinTeam DMO file triggers a heap out‑of‑bounds read. The attacker can supply a 12‑ or 13‑byte file that passes decryption, allowing out‑of‑band access to memory beyond the packed_module buffer. This can lead the application to read unintended memory contents, potentially exposing data or causing a crash. The weakness is catalogued as CWE‑125.

Affected Systems

AdPlug version 2.4 and earlier, distributed under the AdPlug project. The issue affects any instance that loads DMO files via CAdPlug::factory in the AdPlug source code. Users of AdPlug 2.4 or earlier who run the program on systems where potentially malicious DMO files can be supplied are impacted.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate severity. The EPSS is below 1%, indicating a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must supply a crafted DMO file that is parsed by the vulnerable AdPlug component, so the typical attack vector is local or involves users opening untrusted files. The read can leak memory data and lead to an application crash, but does not enable remote code execution.

Generated by OpenCVE AI on October 16, 2026 at 16:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest AdPlug release that removes the out‑of‑bounds read
  • Validate DMO file sizes and contents before passing them to the loader to prevent truncated inputs
  • Run AdPlug in a sandbox or isolated environment to contain potential crashes and memory leaks

Generated by OpenCVE AI on October 16, 2026 at 16:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.
Title AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load
First Time appeared Adplug Project
Adplug Project adplug
Weaknesses CWE-125
CPEs cpe:2.3:a:adplug_project:adplug:*:*:*:*:*:*:*:*
Vendors & Products Adplug Project
Adplug Project adplug
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Adplug Project Adplug
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T19:56:53.161Z

Reserved: 2026-10-14T22:21:21.397Z

Link: CVE-2026-110877

cve-icon Vulnrichment

Updated: 2026-10-15T19:56:40.680Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T19:17:24.823

Modified: 2026-10-16T18:25:45.343

Link: CVE-2026-110877

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T17:00:12Z

Weaknesses