Heap Out-of-Bounds Write Vulnerability in libInstPatch Product by Swami
CVE-2026-111136
6.9MEDIUM
What is CVE-2026-111136?
libInstPatch up to version 1.1.7 is vulnerable to a heap out-of-bounds write in its SoundFont 2 loader. The function ipatch_sf2_gen_is_valid() fails to properly validate generator IDs, allowing attackers to create malicious SF2 files with invalid generator IDs. By exploiting this oversight, attackers can manipulate memory traffic and write arbitrary values beyond the intended buffer, resulting in memory corruption and potential crashes for applications that utilize the library, such as Swami. Securing your installations from this vulnerability is critical to maintaining system integrity.
Affected Version(s)
libinstpatch 0 <= 1.1.7
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology