The vulnerability is a heap out‑of‑bounds read in the IMF_Load() loader of libmikmod, allowing an attacker to read memory beyond what has been allocated by supplying a specially crafted IMF module. By enabling the linear‑period header flag and mapping notes to out‑of‑range samples, an attacker can cause noteindex indexing far past the heap allocation, which can lead to application crashes and potential information disclosure.

The affected product is libmikmod from the sezero vendor, versions up through 3.3.15. The bug is present in the IMF loader implementation referenced in the official source repository and can affect any system using this library version to read IMF module files.

With a CVSS score of 6.8, the severity is medium. The EPSS score is less than 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted IMF module that the application accepts and processes, which may be difficult in practice but could cause application crashes or subtle data leakage if the attacker can influence the environment where the library executes.