CVE-2026-111155
MediumCVSS 6.1Summary
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash the application.
Risk Assessment
The vulnerability can lead to application crashes (denial of service) and potential heap memory data leakage. The risk affects applications loading untrusted SoundFont (.sf2) files.
Recommendation
Update libTiMidity to a version newer than 0.2.8 if available, or avoid loading untrusted .sf2 files. Consider validating sampleId and generator values before using them as table indices.
Other vulnerabilities in libTiMidity
See all- CVE-2026-111156Medium
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
- CVE-2026-111154Medium
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
Original NVD description (English source)
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS