Heap Out-of-Bounds Read Vulnerability in WildMIDI by Mindwerks
CVE-2026-111163

6.8MEDIUM

Key Information:

Vendor

Mindwerks

Status
Wildmidi
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111163?

A heap out-of-bounds read vulnerability exists in WildMIDI version 0.5.0 within the _WM_ParseNewHmi() function, which can lead to reading past allocated buffers. This vulnerability is triggered when attackers supply a specially crafted HMI file that includes a 0xfe 0x10 sub-event positioned close to the buffer's end, allowing data to be read up to four bytes beyond the intended bounds. Such exploitation may result in application crashes and can compromise the stability and integrity of the application.

Affected Version(s)

WildMIDI 0 <= 0.5.0

References

https://hackmd.io/@haind-pwn/wildmidi-hmp-chunk-length-un...
technical-description
https://github.com/Mindwerks/wildmidi/blob/340472ed4633d1...
technical-description
https://github.com/Mindwerks/wildmidi
product

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.