CVE-2026-111163: WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmi
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in WMParseNewHmi() in src/fhmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
An attacker must supply a crafted HMI file containing a 0xfe 0x10 sub-event positioned near the end of a buffer. Exploitation requires a user or application to decode that malicious file.
Who is exposed to this vulnerability?
Applications using WildMIDI through version 0.5.0 to process attacker-controlled or otherwise untrusted HMI files are exposed. The documented impact is a crash of the decoding application from reading up to four bytes beyond an allocation.
Does exploitation require prior access or elevated privileges?
The supplied severity vector indicates local attack access, low attack complexity, no privileges required, and user interaction required. The interaction is consistent with having the vulnerable application open or decode the crafted HMI file.