CVE-2026-111156: libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libTiMidity through 0.2.8 are exposed when they load an attacker-supplied or otherwise untrusted SF2 SoundFont file.
What must an attacker provide to trigger the vulnerability?
The attacker needs to cause the application to process a crafted .sf2 file containing preset header bank or preset values that index beyond the 128-entry tonebank or drumset arrays. The supplied vector indicates local attack access and user interaction are required.
What is the likely impact of successful exploitation?
Malformed preset indexes can cause out-of-bounds heap reads and writes, leading to memory corruption and application crashes. The reported impact includes high availability impact and low integrity impact, with no confidentiality impact.
How can teams reduce risk before a fix is available?
Do not load untrusted SF2 files in affected applications. Restrict SoundFont sources to validated, trusted files and prevent users or local processes from selecting arbitrary .sf2 inputs.