libTiMidity EUVD-2026-102282

Exploitation requires that the target application call libTiMidity's mid_set_soundfont() to load an attacker-controlled .sf2 SoundFont file (through libTiMidity version 0.2.8 or earlier); the specific trigger is a crafted sampleId value and/or instrument generator value used directly as a table index in the SoundFont loader (src/sndfont.c). LIMITING FACTORS: the attack is local (AV:L) and requires passive user interaction (UI:P) - the victim must open or load the malicious SoundFont, so there is no remote or autonomous exploitation; impact is limited to a heap out-of-bounds read yielding memory disclosure and application crash, with no confirmed integrity or code-execution impact. Any product that does not parse untrusted/third-party SoundFont files is effectively unaffected.

This is a genuine but moderate-priority issue, not a critical remote threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H, score 6.9) describes a LOCAL attack requiring passive user interaction - the victim must load an attacker-supplied .sf2 SoundFont file via mid_set_soundfont(). This is not network-reachable despite PR:N, so the PR:N (no privileges) is offset by the mandatory file-delivery and UI:P requirement. Impact is dominated by availability (VA:H, application crash) with only low confidentiality (VC:L, limited heap memory disclosure via out-of-bounds read); there is no integrity impact and no code execution asserted in the description. Publicly available exploit code exists (reported by VulnCheck), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. NOTE A CONFLICT: the exploit reference (hackmd) is titled '...generator-oper-oob-write' implying an out-of-bounds WRITE, while the CVE description and CWE-125 both specify an out-of-bounds READ - verify whether a write primitive also exists, as that would materially increase severity beyond crash/info-leak. Net: a real, confirmed-with-POC bug worth patching in any product that parses untrusted SoundFonts, but the local vector and user-interaction requirement keep real-world risk moderate rather than urgent.

An attacker crafts a malicious .sf2 SoundFont file with manipulated sampleId or instrument generator values and delivers it to a victim (e.g., bundled with a MIDI package or hosted for download). When the victim's application loads the file through libTiMidity's mid_set_soundfont(), the unvalidated indices drive an out-of-bounds heap read, leaking adjacent heap memory and/or crashing the application. Publicly available exploit code (VulnCheck) demonstrates the condition, and the local/user-interaction nature means delivery relies on social engineering or malicious content distribution.