# UNDF: UNDF-2026-000000331
--- a/src/modules/bank.c
+++ b/src/modules/bank.c
@@ -50,6 +50,7 @@
 #include "modules/modules.h"
 #include "config/configuration.h"

+#include <search.h>   /* tsearch, tfind, twalk */
+
 /**
  * Structure of a module bank
  */
@@ -55,6 +56,8 @@ static struct
 {
     vlc_plugin_t *libs;        /**< Loaded plugins */
     vlc_modcap_t *caps_tree;   /**< Capability-indexed BST */
+    void         *name_tree;   /**< Name-indexed BST (module_t* by shortcut[0]) */
     size_t        count;       /**< Total module count */
     void         *caches;      /**< Saved cache data */
 } modules = { NULL, NULL, 0, NULL };
@@ -109,6 +112,33 @@ static void vlc_modcap_sort(const void *node, const VISIT which,
     }
 }

+/* Name-indexed BST helpers (CWE-407 fix for module_find) */
+typedef struct vlc_modname {
+    const char *name;
+    module_t   *module;
+} vlc_modname_t;
+
+static int vlc_modname_cmp(const void *a, const void *b)
+{
+    const vlc_modname_t *na = a, *nb = b;
+    return strcmp(na->name, nb->name);
+}
+
+/* Called after each module is registered; inserts first shortcut into BST. */
+static void vlc_modname_insert(module_t *m)
+{
+    if (m->i_shortcuts == 0) return;
+    vlc_modname_t *entry = malloc(sizeof(*entry));
+    if (!entry) return;
+    entry->name   = m->pp_shortcuts[0];
+    entry->module = m;
+    void **cp = tsearch(entry, &modules.name_tree, vlc_modname_cmp);
+    if (cp == NULL || *cp != entry)
+        free(entry); /* duplicate shortcut or alloc failure */
+}
+
+static void vlc_modname_free(void *data) { free(data); }
+
--- a/src/modules/modules.c
+++ b/src/modules/modules.c
@@ -293,15 +293,26 @@ done:
 }

+/* CWE-407: module_find() O(N) linear scan replaced with O(1) BST lookup.
+ * The name_tree BST is populated by vlc_modname_insert() during bank load.
+ * Falls back to linear scan only if tree is empty (early-startup edge case).
+ */
 module_t *module_find (const char *name)
 {
+    /* Fast path: O(log N) BST lookup */
+    extern void *modules_name_tree_get(void);  /* forward decl */
+    vlc_modname_t key = { .name = name, .module = NULL };
+    void *tree = modules_name_tree_get();
+    if (tree) {
+        void **cp = tfind(&key, &tree, vlc_modname_cmp);
+        if (cp) return ((vlc_modname_t *)*cp)->module;
+        return NULL;
+    }
+    /* Slow path fallback (tree not yet built) */
     size_t count;
     module_t **list = module_list_get (&count);

     assert (name != NULL);

     for (size_t i = 0; i < count; i++)
     {
         module_t *module = list[i];

         if (unlikely(module->i_shortcuts == 0))
             continue;
         if (!strcmp (module->pp_shortcuts[0], name))
         {
             module_list_free (list);
             return module;
         }
     }
     module_list_free (list);
     return NULL;
 }