CVE-2026-111156 Details
Description
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
A memory corruption vulnerability has been identified in libTiMidity versions through 0.2.8. The issue arises in the SoundFont loader, specifically within the 'init_soundfont' function of 'src/sndfont.c'. This vulnerability allows attackers to cause out-of-bounds memory access by providing unvalidated bank and preset values in the SF2 file format. Exploitation of this vulnerability can lead to heap memory corruption, application crashes, and potentially controlled memory writes.
Users can upgrade to libTiMidity version 0.2.9 or later, where this vulnerability has been addressed. For those unable to upgrade, a temporary workaround is to avoid using SoundFonts that contain unvalidated preset header values.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libTiMidity | >= 0.2.8, <= 0.2.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |