CVE-2026-111156: sezero libtimidity Out-of-bounds Write

Vulnerability summary

CVE-2026-111156 is a medium (CVSS 6.9) Out-of-bounds Write vulnerability in sezero libtimidity. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-10-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.