The library uses a static 191-byte array for pattern loops. When an incoming MIDI event has an unmapped sample index of zero, the code subtracts one before indexing, causing an out‑of‑bounds read of the byte before the array. This read can leak adjacent static data and influences whether a note event is treated as looped, potentially exposing internal data or subtly altering playback but not enabling code execution.

Konstanty Bialkowski's libmodplug, versions 0.8.9.1 and earlier, are affected. Applications that load MIDI files into libmodplug (e.g., through the public ModPlug_Load API) can trigger the flaw. The vulnerability is present in all builds of libmodplug prior to 0.8.9.2.

The CVSS score of 4.8 indicates moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. The likely attack vector is local or remote file injection via a crafted 32‑byte MIDI file that is parsed by the library. An attacker could read uncontrolled data adjacent to the pattern loop table, which may reveal application memory state. Because the flaw only influences playback logic, the risk of privilege escalation or arbitrary code execution is low, but the confidentiality concern remains.