Denial of Service in WildMIDI by Invalid Memory Access
CVE-2017-11663

6.5MEDIUM

Key Information:

Vendor

Mindwerks

Status
Wildmidi
Vendor
CVE Published:
17 August 2017

Badges

👾 Exploit Exists

What is CVE-2017-11663?

In WildMIDI version 0.4.2, the function responsible for setting MIDI events, _WM_SetupMidiEvent, is prone to a vulnerability that allows attackers to craft malicious mid files. When these files are processed, they trigger an invalid memory read, effectively causing the application to crash. This vulnerability poses significant risks for users as it can lead to a denial of service, compromising the stability and availability of the software.

References

https://www.exploit-db.com/exploits/42433/
exploitx_refsource_EXPLOIT-DB
http://seclists.org/fulldisclosure/2017/Aug/12
mailing-listx_refsource_FULLDISC

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.