CVE-2026-111154
MediumCVSS 6.1Summary
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
Risk Assessment
The vulnerability can lead to stack memory corruption, application crashes, and potentially arbitrary code execution. The risk affects applications loading untrusted SoundFont (.sf2) files.
Recommendation
Update libTiMidity to a version newer than 0.2.8 if available, or avoid loading untrusted .sf2 files. Consider validating pgen/igen operator values before processing.
Other vulnerabilities in libTiMidity
See all- CVE-2026-111156Medium
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
- CVE-2026-111155Medium
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash the application.
Original NVD description (English source)
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS