libADLMIDI CVE-2026-111161

Requires the host application or game engine to embed libADLMIDI version 1.6.2 through 1.6.2.1 and to parse an attacker-supplied MIDI file through adl_openFile() or adl_openData(). The specific trigger is a MIDI note-on event using status byte 0x9F (channel 16) with note value 0x7F (127), which drives a one-element overrun of the noteStates index in BW_MidiSequencer. Limiting factors that reduce real-world risk: exploitation is local/file-based (no network service is exposed), it requires the victim to open or load the malicious file (passive user interaction), and it only affects the narrow 1.6.2-1.6.2.1 version band - applications on other libADLMIDI versions are not in scope. Demonstrated impact is a process crash (DoS); reliable code execution is not established.

The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) yields a base score of 6.9 (Medium), which accurately reflects the real-world risk here rather than overstating it. The attack is LOCAL (AV:L) and requires passive user interaction (UI:P) - a victim must load an attacker-supplied MIDI file into a host application that embeds libADLMIDI - so this is not a remotely-reachable or wormable flaw. No EPSS score was provided in the input, the CVE is NOT on CISA KEV (no confirmed active exploitation), and no KEV/EPSS signals contradict each other. The impact profile is skewed toward availability (VA:H = crash/DoS of the host media player or game engine) with only limited integrity impact (VI:L, consistent with a single-byte off-by-one stack write) and no confidentiality impact (VC:N). Although CWE-787 (out-of-bounds write) can in principle enable code execution, the description and advisory demonstrate only a crash; escalation beyond DoS is NOT confirmed and should not be assumed. A detailed public technical write-up (hackmd) documents the exact triggering bytes (note-on status 0x9F, note 0x7F), which substantially lowers the barrier to reproduction even though no weaponized exploit tool is referenced. Net assessment: a genuine but moderate-priority memory-safety bug - patch in affected deployments, but it is not a drop-everything mass-exploitation event given the local vector, required user interaction, and niche affected library.

An attacker crafts a malicious MIDI file containing a note-on event with status byte 0x9F and note 0x7F and distributes it (e.g., bundled with a game mod, retro music pack, or sent to a user). When the victim opens it in an application or game engine that uses libADLMIDI 1.6.2-1.6.2.1 via adl_openFile() or adl_openData(), the off-by-one index overflows the noteStates array on the stack, corrupting stack memory and crashing the host process. A public technical write-up documents the exact trigger bytes, so reproduction is straightforward, though only a denial-of-service crash has been demonstrated.