Medium
libmodplug — security advisory
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Products
- libmodplug
- Affected versions
- 1:0.8.8.4-4, 1:0.8.8.4-4.1, 1:0.8.8.5-2, 1:0.8.9.0-1, 1:0.8.9.0-2, 1:0.8.9.0-2build1, 1:0.8.9.0-3, 1:0.8.9.0-3build1, 1:0.8.9.0-3build2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-108577
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:54 UTC · Revision 1
Source evidence
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
osv:UBUNTU-CVE-2026-108577
libmodplug
Fixed versions: Not specified
libmodplug
Fixed versions: Not specified
libmodplug
Fixed versions: Not specified
libmodplug
Fixed versions: Not specified
libmodplug
Fixed versions: Not specified
libmodplug
Fixed versions: Not specified
libmodplug
Fixed versions: Not specified
libmodplug
Fixed versions: Not specified
Complete source record
{
"id": "09c1e99f1a9a4b4e60121448ce640fc0aee23d6479e717c36bf714e5259d29da",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-108577",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-108577",
"summary": "A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
"evidence": "osv:UBUNTU-CVE-2026-108577",
"products": [
{
"name": {
"value": "libmodplug",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:0.8.8.4-4",
"evidence": "/affected/0/versions"
},
{
"value": "1:0.8.8.4-4.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libmodplug",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:0.8.8.5-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libmodplug",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:0.8.9.0-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libmodplug",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:0.8.9.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "1:0.8.9.0-2build1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libmodplug",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:0.8.9.0-3",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "libmodplug",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:0.8.9.0-3",
"evidence": "/affected/5/versions"
},
{
"value": "1:0.8.9.0-3build1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "libmodplug",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:0.8.9.0-3build2",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "libmodplug",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:0.8.9.0-3build1",
"evidence": "/affected/7/versions"
},
{
"value": "1:0.8.9.0-3build2",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-108577",
"aliases": [
"UBUNTU-CVE-2026-108577"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmodplug",
"purl": "pkg:deb/ubuntu/libmodplug?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"1:0.8.8.4-4",
"1:0.8.8.4-4.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108577.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmodplug1",
"binary_version": "1:0.8.8.4-4.1"
}
],
"priority_reason": "Remotely triggerable resource consumption via malformed ABC files in libmodplug."
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmodplug",
"purl": "pkg:deb/ubuntu/libmodplug?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1:0.8.8.5-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108577.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmodplug1",
"binary_version": "1:0.8.8.5-2"
}
],
"priority_reason": "Remotely triggerable resource consumption via malformed ABC files in libmodplug."
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmodplug",
"purl": "pkg:deb/ubuntu/libmodplug?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1:0.8.9.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108577.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmodplug1",
"binary_version": "1:0.8.9.0-1"
}
],
"priority_reason": "Remotely triggerable resource consumption via malformed ABC files in libmodplug."
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmodplug",
"purl": "pkg:deb/ubuntu/libmodplug?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1:0.8.9.0-2",
"1:0.8.9.0-2build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108577.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmodplug1",
"binary_version": "1:0.8.9.0-2build1"
}
],
"priority_reason": "Remotely triggerable resource consumption via malformed ABC files in libmodplug."
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmodplug",
"purl": "pkg:deb/ubuntu/libmodplug?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1:0.8.9.0-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108577.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmodplug1",
"binary_version": "1:0.8.9.0-3"
}
],
"priority_reason": "Remotely triggerable resource consumption via malformed ABC files in libmodplug."
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmodplug",
"purl": "pkg:deb/ubuntu/libmodplug?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1:0.8.9.0-3",
"1:0.8.9.0-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108577.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmodplug1",
"binary_version": "1:0.8.9.0-3build1"
}
],
"priority_reason": "Remotely triggerable resource consumption via malformed ABC files in libmodplug."
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmodplug",
"purl": "pkg:deb/ubuntu/libmodplug?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1:0.8.9.0-3build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108577.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmodplug1",
"binary_version": "1:0.8.9.0-3build2"
}
],
"priority_reason": "Remotely triggerable resource consumption via malformed ABC files in libmodplug."
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmodplug",
"purl": "pkg:deb/ubuntu/libmodplug?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1:0.8.9.0-3build1",
"1:0.8.9.0-3build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108577.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmodplug1",
"binary_version": "1:0.8.9.0-3build2"
}
],
"priority_reason": "Remotely triggerable resource consumption via malformed ABC files in libmodplug."
}
}
],
"modified": "2026-10-17T12:59:48.751382972Z",
"provider": "osv",
"upstream": [
"CVE-2026-108577"
],
"references": [
"https://ubuntu.com/security/CVE-2026-108577",
"https://www.cve.org/CVERecord?id=CVE-2026-108577"
]
},
"related_cves": [
{
"value": "CVE-2026-108577",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 359798,
"published_at": "2026-10-11T13:17:00+00:00"
}