CVE-2026-110875
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Oct 15, 2026
Vendor
unknown
Description
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.