CVE-2026-111154: libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted SoundFont (.sf2) file containing out-of-range pgen or igen generator-operator values. Exploitation requires a user to interact with the malicious file, as reflected by the UI:R vector.
Who is exposed?
Applications or workflows that use libTiMidity to load SoundFont files are exposed when they process attacker-controlled or untrusted .sf2 files. The issue affects libTiMidity through version 0.2.8.
What can happen if a malicious SoundFont is loaded?
The crafted generator operators can cause chosen 16-bit values to be written near a stack Layer object. This can crash the application and corrupt stack memory.
What can be done before a fix is available?
Do not load untrusted .sf2 files, and restrict SoundFont inputs to files from trusted sources. Where possible, prevent users or external content from selecting arbitrary SoundFont files.