CVE-2026-111154— libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader
Quick assessment
Affected
sezero libtimidity
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libTiMidity 版本 0.2.8 及之前版本中存在一个栈缓冲区溢出写入漏洞，位于 SoundFont 加载器中。攻击者可以通过在 parse_gen 函数中使用未经验证的生成器操作符来破坏栈内存。攻击者可以提供一个精心构造的 .sf2 文件，其中包含超出范围的 pgen/igen 操作符值，从而在栈 Layer 对象附近写入指定的 16 位值，导致程序崩溃和栈内存损坏。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| sezero | libtimidity | 0.2.8≤ 0.2.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111154
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader
Source: CVE Program / CVE List V5
Vulnerability Description
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| sezero | libtimidity | 0.2.8 ~ 0.2.8 | - |
|
II. Public POCs for CVE-2026-111154
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111154
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111154 (1)
Security Blog Posts for CVE-2026-111154 (1)
Other References for CVE-2026-111154 (1)
Same Patch Batch · sezero · 2026-10-15 · 5 CVEs total
| CVE-2026-111155 | 6.1 MEDIUM | libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont Loader sndfont.c |
| CVE-2026-111156 | 6.1 MEDIUM | libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header |
| CVE-2026-111165 | 5.5 MEDIUM | libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count |
| CVE-2026-111166 | 5.5 MEDIUM | libmikmod through 3.3.15 Heap Out-of-Bounds Read via IMF_Load |
IV. Related Vulnerabilities
Same vendor: sezero
-
CVE-2026-111166
libmikmod through 3.3.15 Heap Out-of-Bounds Read via IMF_Loa -
CVE-2026-111165
libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via -
CVE-2026-111156
libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont -
CVE-2026-111155
libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont L -
CVE-2026-105839
libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader
Same weakness: CWE-787
-
CVE-2026-111382
FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV -
CVE-2026-89062
联想能源管理驱动越界写入致蓝屏 -
CVE-2026-111280
snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClien -
CVE-2026-111275
nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nift -
CVE-2026-111270
libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSou
V. Comments for CVE-2026-111154
No comments yet