CVE-2026-111156— libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header
Quick assessment
Affected
sezero libtimidity
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libTiMidity 0.2.8 及更早版本在 文件中的 函数里存在一个越界访问漏洞。攻击者可通过提供未经验证的 SF2 预设头部的 bank（音源库）和 preset（预设）值，导致内存被破坏。攻击者可以构造一个 .sf2 文件，使其 bank 或 preset 索引超过 128 项的 tonebank（音色库）或 drumset（鼓组）数组，从而引发堆内存的非法读取、写入以及应用程序崩溃。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| sezero | libtimidity | 0.2.8≤ 0.2.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111156
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header
Source: CVE Program / CVE List V5
Vulnerability Description
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| sezero | libtimidity | 0.2.8 ~ 0.2.8 | - |
|
II. Public POCs for CVE-2026-111156
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111156
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111156 (1)
Security Blog Posts for CVE-2026-111156 (1)
Other References for CVE-2026-111156 (1)
Same Patch Batch · sezero · 2026-10-15 · 5 CVEs total
| CVE-2026-111155 | 6.1 MEDIUM | libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont Loader sndfont.c |
| CVE-2026-111154 | 6.1 MEDIUM | libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader |
| CVE-2026-111165 | 5.5 MEDIUM | libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count |
| CVE-2026-111166 | 5.5 MEDIUM | libmikmod through 3.3.15 Heap Out-of-Bounds Read via IMF_Load |
IV. Related Vulnerabilities
Same vendor: sezero
-
CVE-2026-111166
libmikmod through 3.3.15 Heap Out-of-Bounds Read via IMF_Loa -
CVE-2026-111165
libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via -
CVE-2026-111155
libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont L -
CVE-2026-111154
libTiMidity through 0.2.8 Stack Out-of-Bounds Write via pars -
CVE-2026-105839
libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader
Same weakness: CWE-787
-
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-85746
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nest -
CVE-2026-105958
Spice-server: spice: heap oob read/write via unchecked migra -
CVE-2026-111382
FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV
V. Comments for CVE-2026-111156
No comments yet