Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111163— WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmi

Quick assessment

Affected
Mindwerks WildMIDI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WildMIDI 0.5.0 及更早版本中存在堆越界读取漏洞，位于 文件中的 函数内。该漏洞在处理值为 0xfe 的子事件时，会读取超出缓冲区边界的数据。攻击者可以构造一个恶意的 HMI 文件，在缓冲区末尾附近放置一个值为 0xfe 0x10 的子事件，从而读取分配缓冲区之后最多四个字节的数据，导致解码应用程序崩溃。

CVSS 5.5 · Medium

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
Mindwerks WildMIDI ≤ 0.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111163

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmi
Source: CVE Program / CVE List V5
Vulnerability Description
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Mindwerks WildMIDI 0 ~ 0.5.0 -

II. Public POCs for CVE-2026-111163

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111163

请登录查看更多情报信息。

Other References for CVE-2026-111163 (4)

IV. Related Vulnerabilities

Same product: WildMIDI
Same vendor: Mindwerks
Same weakness: CWE-125

V. Comments for CVE-2026-111163

No comments yet

Leave a comment