CVE-2026-111155: Out-of-bounds Read in sezero libtimidity

The vulnerability exists in libTiMidity through version 0.2.8 in the src/sndfont.c file. The SoundFont loader does not properly validate sampleId and instrument generator values before using them as indices into tables, leading to a heap out-of-bounds read. An attacker can exploit this by providing a malicious .sf2 file loaded via the mid_set_soundfont() function, causing the application to access memory outside the allocated heap region, which may result in a crash.

Successful exploitation can cause the application to read memory out of bounds on the heap, leading to a crash. There is no indication of code execution or privilege escalation. The CVSS 4.0 score is 6.9 (medium severity), reflecting local attack vector with low complexity and no privileges required but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid loading untrusted or malicious .sf2 files with libTiMidity.