CVE-2026-111155: libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont Loader sndfont.c
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont() to read heap memory out of bounds and crash the application.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The attacker must supply a crafted SoundFont (.sf2) file that the application loads through mid_set_soundfont(). Exploitation requires local attack conditions and user interaction, as reflected by the CVSS vector.
What is the expected impact of a successful exploit?
A crafted file can cause the SoundFont loader to read heap memory out of bounds and crash the application. The supplied severity data indicates low confidentiality impact and high availability impact, with no integrity impact.
Which deployments are exposed?
Applications using libTiMidity through version 0.2.8 are exposed when they load attacker-controlled or otherwise untrusted .sf2 SoundFont files through mid_set_soundfont().
How can exposure be reduced before a fix is available?
Do not load untrusted .sf2 files through mid_set_soundfont(). Restrict SoundFont selection to trusted, controlled files and prevent users or untrusted inputs from choosing arbitrary SoundFont paths.