Heap Buffer Overflow in libmt32emu Affects Munt Vendor
CVE-2026-121941

8.5HIGH

Key Information:

Vendor

Munt

Status
LIBMt32emu
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121941?

The libmt32emu software, particularly prior to version 2.8.4, is susceptible to a heap buffer overflow due to improper handling of oversized and unterminated SysEx messages. This vulnerability, found in the MidiStreamParserImpl::parseSysex function, occurs when attackers exploit the API (mt32emu_parse_stream) by sending excessive data packets. If the total SysEx data exceeds 32768 bytes, it may corrupt heap memory, resulting in application crashes and potential malicious access.

Affected Version(s)

libmt32emu 0 < 2.8.4

References

https://github.com/munt/munt/issues/149
issue-tracking
https://hackmd.io/@haindpwn/munt-midistreamparser-oversiz...
third-party-advisory
https://github.com/munt/munt/commit/1749f7fed5cdb3a9015ac...
patch

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.