{"id":"CVE-2026-111156","title":"libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values","summary":"libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft …","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwe":["CWE-787"],"vendor":"sezero","product":"libtimidity","affected":["libtimidity >= 0.2.8 <= 0.2.8"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T19:17:30.527","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111156","references":[{"url":"https://github.com/sezero/libtimidity","label":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/libtimidity/blob/a52adf6aee2635e2a16797213a089c2180e67757/src/sndfont.c#L199-L224","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haind-pwn/libtimidity-soundfont-generator-oper-oob-write","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/libtimidity-through-0.2.8-out-of-bounds-access-via-soundfont-preset-header","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"ingestedAt":"2026-10-15T19:25:46.417Z","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T19:33:39.933334Z"},"slug":"CVE-2026-111156","body":"## Overview\n\nlibTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222734,"id":"CVE-2026-111156","ts":1792097068520,"field":"exploit_available","old":"false","new":"true"}]}