PT-2026-115162

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init soundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...