CVE-2026-111136: libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use affected libInstPatch versions to load SoundFont 2 files are exposed, including Swami and other consumers of the library. The vulnerable path is the SoundFont 2 loader.
What does an attacker need to exploit it?
An attacker needs to get a crafted SF2 file processed by the affected loader. The malicious file contains out-of-range pgen or igen generator IDs.
What is the likely impact of processing a malicious file?
The crafted generator IDs can cause attacker-chosen values to be written past the zone genarray, corrupting heap memory. This can crash the consuming application.
How can I determine whether a file may be attempting to trigger the flaw?
Inspect SF2 pgen and igen generator IDs for values outside the valid generator-ID range before loading the file. The vulnerable behavior occurs because those IDs are not range-checked before the validity-mask test.