CVE-2026-111156

A flaw was found in libtimidity. By providing a specially crafted SoundFont .sf2 file with unvalidated preset header values, an attacker can trigger out-of-bounds heap memory access in the initsoundfont function. This issue can lead to heap memory corruption or an application crash, resulting in ...

CVE-2026-111154

A flaw was found in libtimidity. The SoundFont loader fails to properly validate generator operator values during file parsing, leading to a stack-based out-of-bounds write. By convincing a user to open a specially crafted SoundFont .sf2 audio file, an attacker can corrupt stack memory and crash...

CVE-2026-111155

A flaw was found in libtimidity. The SoundFont loader fails to properly validate sample and instrument index values, leading to an out-of-bounds memory read. An attacker could exploit this vulnerability by providing a specially crafted SoundFont .sf2 audio file, causing the application to crash a...

DEBIAN-CVE-2026-111156

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

DEBIAN-CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

DEBIAN-CVE-2026-111155

libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont to read heap memory out of...

CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111155

libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont to read heap memory out of...

CVE-2026-111156

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

CVE-2026-111156

The libTiMidity library, in versions through 0.2.8 , is vulnerable to an out-of-bounds access flaw within the init_soundfont() function in src/sndfont.c. The root cause is the processing of unvalidated SF2 preset header bank and preset values . By providing a maliciously crafted .sf2 file with ba...

CVE-2026-111156

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

CVE-2026-111156 libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

EUVD-2026-102283

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

CVE-2026-111156 libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

CVE-2026-111155 libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont Loader sndfont.c

libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont to read heap memory out of...

EUVD-2026-102282

libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont to read heap memory out of...

CVE-2026-111155

libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont to read heap memory out of...

CVE-2026-111155

libTiMidity versions through 0.2.8 are vulnerable to a heap out-of-bounds read in the SoundFont loader located at src/sndfont.c. The root cause is the use of unvalidated sampleId and instrument generator values as table indices. An attacker can provide a crafted .sf2 file via the mid_set_soundfon...

CVE-2026-111154 libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

EUVD-2026-102281

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...