CVE-2026-121941: libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex
libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emuparsestream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libmt32emu before 2.8.4 are exposed if they pass attacker-controlled MIDI stream data to the mt32emu_parse_stream API. Relevant input paths include MIDI files, MIDI ports, and sequencer clients.
What does an attacker need to exploit the vulnerability?
An attacker needs to cause the application to process an oversized, unterminated SysEx message containing more than 32,768 SysEx data bytes. The attack requires user interaction according to the supplied vector.
What can happen if exploitation succeeds?
The oversized SysEx input can write past a heap allocation, corrupting heap memory. The provided data states that this can crash the application.
What version addresses the issue?
Upgrade libmt32emu to version 2.8.4 or later. Versions before 2.8.4 are affected.