libTiMidity CVE-2026-111154

Exploitation requires the victim's application to load an attacker-supplied, crafted .sf2 SoundFont file through libTiMidity's SoundFont loader, where parse_gen reads out-of-range pgen/igen generator operator values. Key limiting factors: the CVSS vector is local (AV:L) and requires passive user interaction (UI:P) - the victim must open or process the malicious SoundFont - so there is no remote, autonomous exploitation; impact is primarily denial of service (crash) with only a constrained 16-bit write primitive, and exploitation depends on the host application actually using libTiMidity's .sf2 loading path.

Signals point to a moderate, file-parsing memory-safety bug rather than a top priority. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) describes a local attack requiring the victim to process a malicious file, with the dominant impact being availability (VA:H, crashes) and only limited integrity (VI:L, bounded 16-bit writes) and no confidentiality loss - consistent with the description of a stack out-of-bounds write of chosen 16-bit values near the Layer object. A public POC/write-up exists (publicly available exploit code exists), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of widespread or active exploitation; the POC demonstrates feasibility, not in-the-wild use. CWE-787 plus a controllable 16-bit write raises the theoretical ceiling toward code execution, but the vector's VI:L/VC:N rating and the 'causing crashes' framing suggest reliable arbitrary-code execution is not established. Net: a real, confirmed bug worth patching in affected deployments, but local+UI-dependent exploitation and the lack of KEV/EPSS keep it well below internet-facing critical issues. Note the input mixes signals - POC availability does not equal active exploitation, and the 16-bit write primitive means I:L/VI:L may understate the ceiling if exploitation is refined; treat RCE potential as unverified.

An attacker distributes a crafted .sf2 SoundFont file (e.g., bundled with a song, shared online, or embedded in game/audio content) to a victim whose application uses libTiMidity for MIDI rendering. When the victim loads the file, parse_gen processes out-of-range pgen/igen generator operators and writes attacker-chosen 16-bit values past the stack Layer object, corrupting stack memory and crashing the process. A public POC write-up from VulnCheck demonstrates the out-of-bounds write.