CVE-2026-111161 Details
Description
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.
A stack out-of-bounds write vulnerability has been identified in libADLMIDI versions 1.6.2 through 1.6.2.1. This vulnerability, located in the BW_MidiSequencer component, arises from an off-by-one error in the note-state management of the MIDI file parsing process. The flaw allows attackers to corrupt stack memory by crafting specific MIDI files and using them through the library's public APIs, adl_openFile() or adl_openData(). The vulnerability can cause the hosting media player or game engine to crash.
The vulnerability can be fixed by changing the note-state array size from 0x7FF to 0x800, ensuring it can accommodate the full range of possible note indices.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wohlstand libADLMIDI | >= 1.6.2, <= 1.6.2.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |