Libtimidity
Monthly
Out-of-bounds write in libTiMidity through 0.2.8 allows unauthenticated local attackers to corrupt heap memory and crash applications by loading a crafted SoundFont (.sf2) file whose preset header 'bank' or 'preset' values index past the fixed 128-entry tonebank or drumset arrays in init_soundfont(). The vendor CVSS 4.0 base score is 6.9 (moderate), reflecting high availability impact (crash) and low integrity impact, with exploitation requiring passive user interaction to open the malicious file. Publicly available exploit code exists, increasing the likelihood of targeted attacks against applications that process untrusted SoundFonts.
Heap out-of-bounds reads in the SoundFont loader (src/sndfont.c) of libTiMidity 0.2.8 and earlier allow an attacker to disclose heap memory and crash an application whenever a crafted .sf2 SoundFont is loaded through mid_set_soundfont(). The attack is local and requires the victim to open or otherwise load the malicious SoundFont (UI:P with AV:L), so the impact is bounded to low-confidentiality memory disclosure and a high-availability crash, with no confirmed integrity loss or code execution; any product that never parses untrusted or third-party SoundFont files is effectively unaffected. Publicly available exploit code exists - a public writeup and the referenced upstream source lines demonstrate the unvalidated sampleId/generator indexing - but there is no evidence of active exploitation, and exploitation prerequisites make this a moderate-priority rather than a critical remote threat.
Stack out-of-bounds write in libTiMidity through 0.2.8 occurs when the SoundFont loader parses crafted .sf2 files, allowing an unauthenticated local attacker to corrupt stack memory via out-of-range pgen/igen generator operators in parse_gen, which writes chosen 16-bit values near the stack Layer object. This leads primarily to denial of service (crash) with a constrained memory corruption primitive; exploitation requires the victim to load a malicious SoundFont file (user interaction), and publicly available exploit code exists but there is no confirmed active exploitation. The assessed severity is moderate (CVSS 3.1 base score 6.1), consistent with a file-parsing memory-safety bug rather than a top-priority threat.
Out-of-bounds write in libTiMidity through 0.2.8 allows unauthenticated local attackers to corrupt heap memory and crash applications by loading a crafted SoundFont (.sf2) file whose preset header 'bank' or 'preset' values index past the fixed 128-entry tonebank or drumset arrays in init_soundfont(). The vendor CVSS 4.0 base score is 6.9 (moderate), reflecting high availability impact (crash) and low integrity impact, with exploitation requiring passive user interaction to open the malicious file. Publicly available exploit code exists, increasing the likelihood of targeted attacks against applications that process untrusted SoundFonts.
Heap out-of-bounds reads in the SoundFont loader (src/sndfont.c) of libTiMidity 0.2.8 and earlier allow an attacker to disclose heap memory and crash an application whenever a crafted .sf2 SoundFont is loaded through mid_set_soundfont(). The attack is local and requires the victim to open or otherwise load the malicious SoundFont (UI:P with AV:L), so the impact is bounded to low-confidentiality memory disclosure and a high-availability crash, with no confirmed integrity loss or code execution; any product that never parses untrusted or third-party SoundFont files is effectively unaffected. Publicly available exploit code exists - a public writeup and the referenced upstream source lines demonstrate the unvalidated sampleId/generator indexing - but there is no evidence of active exploitation, and exploitation prerequisites make this a moderate-priority rather than a critical remote threat.
Stack out-of-bounds write in libTiMidity through 0.2.8 occurs when the SoundFont loader parses crafted .sf2 files, allowing an unauthenticated local attacker to corrupt stack memory via out-of-range pgen/igen generator operators in parse_gen, which writes chosen 16-bit values near the stack Layer object. This leads primarily to denial of service (crash) with a constrained memory corruption primitive; exploitation requires the victim to load a malicious SoundFont file (user interaction), and publicly available exploit code exists but there is no confirmed active exploitation. The assessed severity is moderate (CVSS 3.1 base score 6.1), consistent with a file-parsing memory-safety bug rather than a top-priority threat.