CVE-2026-111154 libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111154

The libTiMidity library, through version 0.2.8 , is vulnerable to a stack out-of-bounds write in the SoundFont loader. The root cause is located in the parse_gen function, where unchecked generator operators allow for the processing of out-of-range pgen/igen operator values. By supplying a crafte...

EUVD-2026-102281

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111151 OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row pa...

CVE-2026-111151 OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row pa...

EUVD-2026-102278

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row pa...

CVE-2026-111151

OpenJPH versions through 0.32.0 are vulnerable to a heap out-of-bounds write within the HTJ2K cleanup-pass decoder . The root cause involves processing one-row codeblocks where a crafted .j2c or .jph codestream with small precinct sizes causes the decoder to write a second row beyond the allocate...

CVE-2026-111151 OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row pa...

CVE-2026-111151

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row pa...

CVE-2026-111137 libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL

libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets...

CVE-2026-111137 libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL

libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets...

CVE-2026-111137

The libsmi library, versions through 0.5.0 , is vulnerable to an out-of-bounds write in the smiValueAsString() function located in lib/smi.c . The root cause is a buffer overflow of a fixed 1024-byte static buffer during the hex rendering of OCTET STRING values. An attacker can trigger this by su...

CVE-2026-111137

libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets...

CVE-2026-111136 libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write...

EUVD-2026-102263

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write...

CVE-2026-111136 libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write...

CVE-2026-111136 libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write...

CVE-2026-111136

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write...

CVE-2026-111136

The libInstPatch library (through version 1.1.7 ) is vulnerable to a heap out-of-bounds write in its SoundFont 2 loader. The root cause is that the ipatch_sf2_gen_is_valid() function fails to perform a range-check on generator IDs before executing a validity mask test. An attacker can exploit thi...