CVE-2026-111162

The WildMIDI library, version 0.5.0 and earlier, contains a heap out-of-bounds read vulnerability within the HMP parser function _WM_ParseNewHmp() . The root cause is an underflowed chunk length ; by supplying a crafted .hmp file with a chunk length between 0-12 , the value wraps to approximately...

CVE-2026-19082

The Perl Imager module (versions 0.45_02 before 1.034 ) is vulnerable to a heap over-read in the copy_string_tags() function. The root cause is that a zero-count ASCII EXIF entry sets entry->size to 0, resulting in a length of -1; this causes i_tags_add() to invoke strlen(), which scans past t...