Libadlmidi
Monthly
Off-by-one stack out-of-bounds write in libADLMIDI 1.6.2 through 1.6.2.1 lets an attacker corrupt stack memory in the BW_MidiSequencer when a crafted MIDI file is parsed through adl_openFile() or adl_openData(). The trigger is a note-on event with status byte 0x9F and note 0x7F (127), which overruns the noteStates index and can crash the hosting media player or game engine. This is a local, file-based issue requiring the victim to load the malicious MIDI (CVSS 6.9 Medium); no public exploit identified at time of analysis, and the demonstrated impact is denial of service rather than reliable code execution.
Off-by-one stack out-of-bounds write in libADLMIDI 1.6.2 through 1.6.2.1 lets an attacker corrupt stack memory in the BW_MidiSequencer when a crafted MIDI file is parsed through adl_openFile() or adl_openData(). The trigger is a note-on event with status byte 0x9F and note 0x7F (127), which overruns the noteStates index and can crash the hosting media player or game engine. This is a local, file-based issue requiring the victim to load the malicious MIDI (CVSS 6.9 Medium); no public exploit identified at time of analysis, and the demonstrated impact is denial of service rather than reliable code execution.