Libinstpatch
Monthly
Heap out-of-bounds write in libInstPatch through 1.1.7 allows a crafted SoundFont 2 (.sf2) file to corrupt process memory when a victim loads it in Swami or any other application that uses the library's SF2 loader. The flaw lives in ipatch_sf2_gen_is_valid(), which fails to range-check pgen or igen generator IDs before the validity-mask test, so out-of-range IDs cause values to be written past the zone genarray into adjacent heap memory, crashing or potentially corrupting the consumer. The vector is local and requires user interaction (the victim must open the untrusted file), no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, though a public technical writeup describing the root cause is available.
Heap out-of-bounds write in libInstPatch through 1.1.7 allows a crafted SoundFont 2 (.sf2) file to corrupt process memory when a victim loads it in Swami or any other application that uses the library's SF2 loader. The flaw lives in ipatch_sf2_gen_is_valid(), which fails to range-check pgen or igen generator IDs before the validity-mask test, so out-of-range IDs cause values to be written past the zone genarray into adjacent heap memory, crashing or potentially corrupting the consumer. The vector is local and requires user interaction (the victim must open the untrusted file), no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, though a public technical writeup describing the root cause is available.