# MilkyTracker v1.06 Vulnerabilities (CVE-2026-36993 / CVE-2026-36994) ## Overview Two memory corruption vulnerabilities were discovered in MilkyTracker v1.06 during fuzz testing of the XM module loader using AFL++ with ASAN instrumentation. The vulnerabilities can be triggered by opening a specially crafted `.XM` file. The issues were responsibly disclosed and assigned the following CVEs by MITRE: - CVE-2026-36993 - CVE-2026-36994 No public proof-of-concept exploit code is being released at this time. --- ## CVE-2026-36993 ### Out-of-Bounds Read in XM Pattern Loader - **Component:** `src/milkyplay/LoaderXM.cpp` - **Function:** `LoaderXM::load()` - **Severity:** Medium A bounds validation issue in the XM pattern parser allows attacker-controlled values to cause out-of-bounds memory reads during pattern processing. A crafted XM file may crash the application or trigger invalid memory access. --- ## CVE-2026-36994 ### Integer Overflow Leading to Heap Corruption - **Component:** `src/milkyplay/XModule.cpp` - **Function:** `XModule::loadModuleSample()` - **Severity:** High An integer overflow occurs during sample size calculations for 16-bit samples. A crafted XM file may trigger heap corruption due to an undersized allocation followed by out-of-bounds memory writes. Successful exploitation may result in application crashes and potentially arbitrary code execution depending on runtime conditions. --- ## Discovery Methodology The vulnerabilities were identified using: - AFL++ - AddressSanitizer (ASAN) - UndefinedBehaviorSanitizer (UBSAN) Testing was performed using a custom in-memory fuzzing harness targeting the XM loader. --- ## Disclosure Timeline | Date | Event | |---|---| | March 2026 | Vulnerabilities discovered | | May 2026 | CVEs assigned by MITRE | | Pending | Vendor remediation | --- ## References - https://www.cve.org/ - https://github.com/milkytracker/MilkyTracker