libTiMidity CVE-2026-111156

Exploitation requires an application built against libTiMidity (<= 0.2.8) to load an attacker-controlled SoundFont (.sf2) file, and the attacker must control the SF2 preset-header 'bank' and 'preset' fields so they index past the fixed 128-entry tonebank or drumset arrays in init_soundfont(). The key limiting factors are: (1) LOCAL attack vector - the malicious file must reach the victim's system; (2) passive user interaction (UI:P) - the victim must actually open/process the crafted SoundFont, so there is no autonomous remote trigger; and (3) the target software must expose SoundFont loading via this library. No authentication or special privileges are needed (PR:N), and default configurations are affected once SF2 loading is used - there is no mitigating non-default setting.

This is a moderate-severity memory-corruption flaw (vendor CVSS 4.0 base 6.9) whose real-world risk is constrained by its exploitation model rather than its technical impact. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) tells the real story: although no privileges are required (PR:N), the attack vector is LOCAL and requires passive user interaction (UI:P) - a victim must open or process an attacker-supplied .sf2 SoundFont file. This is not a remotely-reachable, self-propagating issue. A publicly available exploit/write-up exists (VulnCheck advisory and a hackmd technical analysis), but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - status is best described as 'publicly available exploit code exists,' which is distinct from in-the-wild use. The impact metrics (VC:N/VI:L/VA:H) emphasize availability loss (crashes) with limited integrity impact and no confidentiality impact per the vendor vector; however, the description explicitly mentions heap out-of-bounds WRITES (CWE-787), so the integrity rating of only VI:L is arguably conservative and code-execution potential should be treated as plausible rather than dismissed. Net assessment: a legitimate issue to patch in any software bundling libTiMidity, but a lower operational priority than a network-facing unauthenticated bug - it is a file-parsing vulnerability gated on tricking a user into opening a malicious SoundFont.

An attacker crafts a malicious .sf2 SoundFont file in which a preset-header bank or preset index exceeds the 128-entry tonebank/drumset bounds, then delivers it to a victim who loads it in an application that uses libTiMidity (<= 0.2.8) for MIDI rendering. When init_soundfont() parses the file it indexes past the fixed arrays, corrupting heap memory and crashing the application, with potential for controlled out-of-bounds writes. A public technical write-up and exploit material are already available, lowering the barrier to reproduction.