CVE-2026-111156

MediumCVSS 6.1/10Last modified Oct 16, 2026

Description

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1111576.1SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd saCVE-2026-1111585.5EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncatedCVE-2026-1111596.1libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name anCVE-2026-111168.8Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious netwoCVE-2026-1111607.5LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supCVE-2026-1111616.1libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers toCVE-2026-1111626.1WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beCVE-2026-1111635.5WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when hanCVE-2026-1111645.5UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction CVE-2026-1111655.5libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channelCVE-2026-1111665.5libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond alloCVE-2026-1111676.1GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers t
CVE-2026-111156: Medium severity, CVSS 6.1 | Vulnix