libopenmpt and openmpt123 - libopenmpt security updates 0.8.9, 0.7.21, 0.6.30, 0.5.44, 0.4.56

The OpenMPT/libopenmpt project released the latest stable libopenmpt version:

libopenmpt 0.8.9 (2026-08-19)

[Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx . Found by Tristan Madani.
[Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).

The changelog for older versions can be found at https://lib.openmpt.org/doc/changelog.html .

Source code download links:

Binary download links:

Development library download links:

Documentation download links:

The OpenMPT/libopenmpt project also released an update to the old libopenmpt 0.6 stable branch:

[Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25626, r25646). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx . Found by Tristan Madani.
[Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25610, r25616).

Source code download links:

Documentation and binary downloads can be found at the libopenmpt website at https://lib.openmpt.org/libopenmpt/.

The OpenMPT/libopenmpt project also released an update to the old libopenmpt 0.6 stable branch:

[Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25629, r25647). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx . Found by Tristan Madani.
[Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25611, r25617).

Source code download links:

Documentation and binary downloads can be found at the libopenmpt website at https://lib.openmpt.org/libopenmpt/.

The OpenMPT/libopenmpt project also released an update to the old libopenmpt 0.5 stable branch:

[Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25612, r25618).

Source code download links:

Documentation and binary downloads can be found at the libopenmpt website at https://lib.openmpt.org/libopenmpt/.

The OpenMPT/libopenmpt project also released an update to the old libopenmpt 0.4 stable branch:

[Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25613, r25619).

Source code download links:

Documentation and binary downloads can be found at the libopenmpt website at https://lib.openmpt.org/libopenmpt/.

The following libopenmpt and libopenmpt-modplug versions are currently supported with security fixes by the OpenMPT/libopenmpt project:

libopenmpt 0.8.9
- Current stable version.
- Receives security updates.
- Receives minor playback fixes.
libopenmpt 0.7.21
- Old stable version.
- Receives security updates.
- Receives trivial bug fixes.
libopenmpt 0.6.30
- Old stable version.
- Receives security updates.
- Receives trivial bug fixes.
libopenmpt 0.5.44
- Old stable version.
- Receives security updates.
- Receives trivial bug fixes.
libopenmpt 0.4.56
- Old stable version.
- Receives security updates.
- Receives trivial bug fixes.
libopenmpt 0.9 (SVN trunk)
- development
- security updates
- playback fixes
- new features
- new file formats
libopenmpt-modplug 0.8.9.0-openmpt1
- Receives security updates.
libopenmpt-modplug 0.8.8.5-openmpt1
- Receives security updates.

Please update to the newest versions.