Heap Out-of-Bounds Read in libTiMidity SoundFont Loader
CVE-2026-111155

6.9MEDIUM

Key Information:

Vendor

Sezero

Status
Libtimidity
Vendor
CVE Published:
15 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-111155?

libTiMidity versions up to 0.2.8 contain a vulnerability in the SoundFont loader that can lead to a heap out-of-bounds read. This issue arises from the use of unvalidated sampleId and instrument generator values as indices in the SoundFont loading process. Attackers can exploit this by providing a specially crafted .sf2 file via the mid_set_soundfont() function, allowing them to access sensitive heap memory and potentially cause the application to crash. It is crucial for users and developers to apply necessary updates and validate inputs to mitigate this risk.

Affected Version(s)

libtimidity 0.2.8

References

https://hackmd.io/@haind-pwn/libtimidity-soundfont-genera...
technical-descriptionexploit
https://github.com/sezero/libtimidity/blob/a52adf6aee2635...
technical-description
https://github.com/sezero/libtimidity
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.