Off-by-One Stack Write Vulnerability in libADLMIDI Media Player
CVE-2026-111161
6.9MEDIUM
What is CVE-2026-111161?
libADLMIDI version 1.6.2 through 1.6.2.1 contains a vulnerability in the BW_MidiSequencer component, allowing attackers to exploit an off-by-one stack out-of-bounds write. By crafting specific MIDI files with a note-on status of 0x9F and note 0x7F, attackers can cause memory corruption, potentially crashing the associated media player or game engine when the affected functions adl_openFile() or adl_openData() are called.
Affected Version(s)
libADLMIDI 1.6.2 <= 1.6.2.1
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology