WildMIDI CVE-2026-111163

Exploitation requires the victim to open or decode an attacker-crafted HMI-format file using an application that uses WildMIDI through version 0.5.0; the malicious file must contain a 0xfe 0x10 sub-event positioned near the end of the buffer to trigger the over-read in _WM_ParseNewHmi(). Limiting factors: the attack vector is LOCAL (file must be delivered to and processed on the target) and requires user interaction (the victim must actively open/play the file); no authentication or privileges are needed, but there is no network-triggerable path. Impact is limited to a crash of the decoding application (DoS) - the described flaw yields no code execution, no privilege change, and no disclosure of the four over-read bytes to the attacker.

Overall real-world risk is LOW-to-MODERATE and lower than the headline CVSS 4.0 base score of 6.8 would suggest. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) confirms this is NOT a remotely triggerable flaw: the attack vector is LOCAL and requires passive user interaction (UI:P) - the victim must open or decode an attacker-supplied HMI file. The only impact is availability (a crash); there is no confidentiality (VC:N) or integrity (VI:N) impact, so despite the CWE-125 out-of-bounds READ classification, no attacker-controlled data disclosure is described - the bug manifests as a denial of service of the decoding process. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is NOT on the CISA KEV list and no explicit POC/exploit-code flag was provided, so there is no evidence of active exploitation. A detailed public technical write-up (hackmd) and a VulnCheck advisory precisely document the vulnerable code path, which lowers the effort to craft a triggering file, but a 4-byte over-read causing a client-side crash is a nuisance-level DoS, not a priority patch for most environments. CONFLICTING SIGNAL: the input tag 'Information Disclosure' is inconsistent with the description ('crashing the decoding application') and with VC:N - this reads as an availability/DoS issue, not an info-leak; verify impact classification.

An attacker crafts a malicious HMI music file that places a 0xfe 0x10 sub-event near the end of the buffer and distributes it (email attachment, download, embedded media). When a victim opens or plays the file with an application linking WildMIDI ≤0.5.0, _WM_ParseNewHmi() reads up to four bytes past the heap allocation and the application crashes. No public exploit code is identified at time of analysis, but a detailed technical write-up describing the exact trigger is publicly available.