CVE-2026-111136 Details
Description
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.
A heap out-of-bounds write vulnerability has been identified in libInstPatch versions through 1.1.7. The issue arises in the SoundFont 2 loader, specifically within the 'ipatch_sf2_gen_is_valid()' function, which fails to properly range-check generator IDs before conducting a validity mask test. This oversight allows attackers to craft SF2 files with out-of-range generator IDs that, when processed, write user-specified values beyond the allocated array for zone generators. This memory corruption can lead to crashes in applications like Swami that utilize libInstPatch.
Users can update to libInstPatch versions after 1.1.7, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libInstPatch | <= 1.1.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |