libmodplug up to version 0.8.9.1 contains a heap‑based out‑of‑bounds read in the CSoundFile::ReadAMS2() routine. Crafting an AMS module with pattern effect bytes that keep the most significant bit set forces the decoder to read past the input buffer, exposing adjacent heap memory. This flaw falls under CWE‑125 and could lead to memory disclosure or a denial‑of‑service crash for any application that processes such a module.

The vulnerability affects Konstanty Bialkowski’s libmodplug version 0.8.9.1 or earlier. Any application that loads AMS modules—such as media players, game engines, or other multimedia tools—may be compromised if the library is not updated.

The CVSS base score of 6.8 indicates moderate severity. The EPSS score is less than 1 %, implying a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted AMS file to a consumer of libmodplug; based on the description, the likely vectors include local or remote file upload or ingestion of AMS modules from external sources.