PatchTheCVE: libmikmodhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2010-2971: loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env rehttps://patchthecve.com/cve/CVE-2010-2971.htmlhttps://patchthecve.com/cve/CVE-2010-2971.htmlTue, 16 Jun 2026 23:21:51 +0000HIGH 9.3: loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issuCVE-2010-2546: Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote athttps://patchthecve.com/cve/CVE-2010-2546.htmlhttps://patchthecve.com/cve/CVE-2010-2546.htmlTue, 16 Jun 2026 23:20:57 +0000HIGH 9.3: Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of CVE-2009-3996: Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmodhttps://patchthecve.com/cve/CVE-2009-3996.htmlhttps://patchthecve.com/cve/CVE-2009-3996.htmlTue, 16 Jun 2026 23:12:47 +0000HIGH 9.3: Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file.CVE-2009-3995: Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, andhttps://patchthecve.com/cve/CVE-2009-3995.htmlhttps://patchthecve.com/cve/CVE-2009-3995.htmlTue, 16 Jun 2026 23:12:47 +0000HIGH 9.3: Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file. NOTE: some of these detaiCVE-2009-0179: libmikmod 3.1.11 through 3.2.0, as used by MikMod and possibly other products, allows user-assisted attackers https://patchthecve.com/cve/CVE-2009-0179.htmlhttps://patchthecve.com/cve/CVE-2009-0179.htmlTue, 16 Jun 2026 23:04:26 +0000MEDIUM 4.3: libmikmod 3.1.11 through 3.2.0, as used by MikMod and possibly other products, allows user-assisted attackers to cause a denial of service (application crash) by loading an XM file.CVE-2007-6720: libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channehttps://patchthecve.com/cve/CVE-2007-6720.htmlhttps://patchthecve.com/cve/CVE-2007-6720.htmlTue, 16 Jun 2026 22:48:38 +0000MEDIUM 4.3: libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application cra