https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-17113.htmlhttps://patchthecve.com/cve/CVE-2019-17113.htmlWed, 17 Jun 2026 02:23:19 +0000CRITICAL 9.8: In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.https://patchthecve.com/cve/CVE-2019-14383.htmlhttps://patchthecve.com/cve/CVE-2019-14383.htmlWed, 17 Jun 2026 02:18:19 +0000MEDIUM 6.5: J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.https://patchthecve.com/cve/CVE-2019-14382.htmlhttps://patchthecve.com/cve/CVE-2019-14382.htmlWed, 17 Jun 2026 02:18:19 +0000MEDIUM 6.5: DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.https://patchthecve.com/cve/CVE-2019-14380.htmlhttps://patchthecve.com/cve/CVE-2019-14380.htmlWed, 17 Jun 2026 02:18:19 +0000MEDIUM 6.5: libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.https://patchthecve.com/cve/CVE-2018-20861.htmlhttps://patchthecve.com/cve/CVE-2018-20861.htmlWed, 17 Jun 2026 01:53:37 +0000MEDIUM 6.5: libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.https://patchthecve.com/cve/CVE-2018-20860.htmlhttps://patchthecve.com/cve/CVE-2018-20860.htmlWed, 17 Jun 2026 01:53:37 +0000MEDIUM 6.5: libopenmpt before 0.3.13 allows a crash with malformed MED files.https://patchthecve.com/cve/CVE-2019-14381.htmlhttps://patchthecve.com/cve/CVE-2019-14381.htmlWed, 17 Jun 2026 02:18:19 +0000HIGH 7.5: libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.https://patchthecve.com/cve/CVE-2018-11710.htmlhttps://patchthecve.com/cve/CVE-2018-11710.htmlWed, 17 Jun 2026 01:36:24 +0000HIGH 8.8: soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an invalid write near address 0 in an out-of-memory situation.https://patchthecve.com/cve/CVE-2018-10017.htmlhttps://patchthecve.com/cve/CVE-2018-10017.htmlWed, 17 Jun 2026 01:33:22 +0000MEDIUM 6.5: soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.https://patchthecve.com/cve/CVE-2018-6611.htmlhttps://patchthecve.com/cve/CVE-2018-6611.htmlWed, 17 Jun 2026 02:02:05 +0000HIGH 8.8: soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read via a malformed STP file.https://patchthecve.com/cve/CVE-2017-11311.htmlhttps://patchthecve.com/cve/CVE-2017-11311.htmlWed, 17 Jun 2026 01:01:36 +0000HIGH 7.8: soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for arbitrary code execution via a crafted PSM File that triggers use of the same sample slot for two samples.