CVE-2026-111154 Details
Description
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
A stack out-of-bounds write vulnerability has been identified in libTiMidity versions through 0.2.8, specifically within the SoundFont loader. This vulnerability allows attackers to corrupt stack memory by exploiting unchecked generator operator values in the 'parse_gen' function. By supplying a crafted .sf2 file with out-of-range pgen/igen operator values, attackers can write chosen 16-bit values near the stack Layer object, leading to crashes and stack memory corruption.
The vulnerability can be fixed by adding a range check for the generator operator in the 'parse_gen' function, ensuring that it only accepts valid values. Additionally, all indices derived from SoundFont files should be clamped against their respective table sizes before use.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libTiMidity | >= 0.2.8, <= 0.2.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |