CVE-2026-111156
MediumCVSS 6.1Summary
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
Risk Assessment
The vulnerability can lead to heap memory corruption, application crashes, and potentially arbitrary code execution. The risk affects applications loading untrusted SoundFont (.sf2) files.
Recommendation
Update libTiMidity to a version newer than 0.2.8 if available, or avoid loading untrusted .sf2 files. Consider validating bank and preset values before using them as array indices.
Other vulnerabilities in libTiMidity
See all- CVE-2026-111155Medium
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash the application.
- CVE-2026-111154Medium
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
Original NVD description (English source)
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS