Heap Out-of-Bounds Read Vulnerability in WildMIDI by Mindwerks
CVE-2026-111162
6.9MEDIUM
What is CVE-2026-111162?
WildMIDI versions up to 0.5.0 are susceptible to a heap out-of-bounds read vulnerability in the HMP parser function _WM_ParseNewHmp(). This vulnerability allows attackers to manipulate chunk lengths, resulting in potential access to unauthorized memory locations. By submitting a specially crafted .hmp file with a chunk length ranging from 0 to 12, attackers can cause an underflow condition that wraps around to approximately 4 GB. This can lead to application crashes or unintended disclosure of sensitive heap data through the WildMidi_GetInfo() function. Timely updates and patches are essential for maintaining security.
Affected Version(s)
WildMIDI 0 <= 0.5.0
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology