CVE-2026-111156: Out-of-bounds Write in sezero libtimidity

libTiMidity through version 0.2.8 contains an out-of-bounds access vulnerability in the init_soundfont() function located in src/sndfont.c. This vulnerability arises from improper validation of SF2 preset header bank and preset values. Specifically, attackers can supply a crafted .sf2 file with bank or preset indexes that exceed the bounds of the 128-entry tonebank or drumset arrays. This causes heap memory corruption through out-of-bounds reads and writes, which can result in application instability or crashes.

The vulnerability allows attackers to corrupt heap memory by triggering out-of-bounds reads and writes. This can cause application crashes and potentially lead to denial of service or other memory corruption consequences. There is no indication of remote code execution or privilege escalation from the provided data. The CVSS 4.0 score is 6.9 (medium severity), reflecting the local attack vector and required user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, avoid processing untrusted .sf2 files or apply application-level restrictions to limit exposure.