The libmikmod audio library contains a global out‑of‑bounds read in the MTM_Load routine because the module’s channel count is never clamped. An attacker can craft a .mtm file with a channel count larger than the supported 32, allowing the loader to read beyond the statically allocated pat array. The unnecessary read can expose arbitrary stack memory, corrupt track indices, and cause the loading application to crash or behave unpredictably.

All releases of libmikmod up to and including version 3.3.15 are vulnerable. Any system that links against this library or runs an application that invokes MTM_Load to load user‑supplied .mtm modules is at risk. The product is maintained by sezero and available from the repository at https://github.com/sezero/mikmod. Deployments exposing the loader to untrusted files should be considered impacted.

The CVSS v3.1 score of 6.8 classifies the flaw as medium severity. An EPSS score of less than 1% indicates a very low probability of current exploitation, and the vulnerability is not in the CISA KEV catalog. The attack vector requires an attacker to supply a malicious .mtm file to the target application, which can happen through local file access or remote upload features that allow arbitrary file loading. Successful exploitation would lead to denial of service or memory content leakage, confined to the host that runs the loader.