Schism Tracker up to the version 20260524 contains a heap out‑of‑bounds write in the configuration loading routine fmt_ult_load_song. The bug allows a maliciously crafted .ult module to supply a one‑byte sample count that exceeds the defined maximum. This overflow overwrites the array of instrument pointers so that when csf_destroy is called it attempts to free attacker‑chosen addresses, leading to an application crash. The impact is the loss of availability of the tracker; further exploitation could potentially involve arbitrary code execution if the freed memory is leveraged in a subsequent vulnerability, but the description explicitly mentions only a crash.

The vulnerability affects all releases of Schism Tracker prior to 20260524 that contain the fmt_ult_load_song implementation. The vendor product is Schism Tracker; no further sub‑product classification is listed. Versions older than 20260524 are affected.

The CVSS score of 6.9 classifies the flaw as moderate severity. No EPSS score is provided and the vulnerability is not listed in the CISA KEV catalog, indicating limited documented exploitation. The likely attack vector is local: an attacker who can supply an arbitrary .ult module to the application can trigger the out‑of‑bounds write and force the program to terminate. Without the presence of a remote code execution pathway, the risk is primarily to availability rather than confidentiality or integrity.