libmodplug implements a heap‑based out‑of‑bounds write in CSoundFile::ReadDSM because the variable nPat is never checked against the defined maximum number of patterns. An attacker can feed a crafted DSM file containing more than 240 PATT chunks or a wrapped patt_len value, causing the pattern table to be written past its allocated bounds. The resulting memory corruption can crash the program that reads the file. The weakness is a classic buffer overrun scenario identified as CWE‑787, and no evidence in the description indicates that it leads to code execution or privilege escalation.

The vulnerability exists in Konstanty Bialkowski’s libmodplug library up through version 0.8.9.1; any software that links to an earlier release of libmodplug is affected.

The CVSS score of 6.9 indicates a moderate to high severity. The EPSS score is less than 1 percent, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation reports yet. The likely attack vector is the supply of a malicious DSM file to an application that parses such files—this can be done locally by a user or potentially remotely if the target software accepts DSM files from a network source. Exploitation would cause the target application to terminate, representing a denial‑of‑service for any user or service relying on that process. No privileged escalation or data disclosure is expected from the described behavior.