JFTR, Till now all MilkyTracker 1.02 (previous release) packages in official Unix-like distro repositories (except FreeBSD) has CVE issues; in MilkyTracker 1.03 it was fixed.[0,1]

[0] https://repology.org/project/milkytracker/versions

[1] https://github.com/milkytracker/MilkyTracker/issues/224