WildMIDI CVE-2026-111162

Exploitation requires the WildMIDI library (≤0.5.0) to parse an attacker-supplied .hmp (HMP format) file whose HMP chunk length field is set to a value between 0 and 12, triggering an unsigned-integer underflow to ~4 GB in _WM_ParseNewHmp(). This is a LOCAL, file-driven attack (AV:L): the attacker cannot reach the code path over the network and must get the malicious file loaded by the target application or user (UI:P / passive interaction), limiting realistic exploitation to workflows that process untrusted .hmp files. No authentication or special privileges are needed (PR:N), and default configurations are affected, but impact is bounded to a crash (DoS) or disclosure of adjacent heap bytes surfaced through WildMidi_GetInfo() - there is no code-execution or write primitive.

This is a genuine but modest-priority issue, not a high-urgency flaw. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) scores 6.9 (Medium) and tells a consistent story: exploitation is LOCAL (the attacker must get a crafted .hmp file parsed on the target), requires passive user interaction (UI:P), needs no privileges, and primarily causes a crash (VA:H) with only limited confidentiality exposure of heap bytes (VC:L) and no integrity impact. No EPSS score, no CISA KEV listing, and no POC flag were provided in the input, so there is no signal of active exploitation or weaponization - this is a bounds-read (CWE-125), not remote code execution. A VulnCheck advisory and a detailed third-party technical write-up (hackmd) exist, which raises the likelihood that exploitation details are public even though no exploit flag was set; this should be verified. The signals are internally consistent (no CVSS-vs-description conflict), but note the attack vector is LOCAL/file-based despite the memorable '4 GB wrap' framing - this is not a network-remote vulnerability. Combined with WildMIDI's niche deployment footprint, real-world risk is limited to contexts where untrusted .hmp files are parsed.

An attacker crafts a malicious .hmp file whose HMP chunk length field is set between 0 and 12, which underflows during subtraction and wraps to roughly 4 GB, driving the parser to read far past the allocated heap buffer. A victim application or user that loads this file through WildMIDI (e.g., a media player or game using the library) then either crashes or, via WildMidi_GetInfo(), returns heap memory contents to the caller. A detailed technical write-up describing the bug exists publicly, though no packaged exploit was indicated in the source data.