Threat database

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.

WildMIDI versions up to 0.5.0 contain a heap out-of-bounds read vulnerability in the HMP parser function _WM_ParseNewHmp(). This flaw allows attackers to craft .hmp files with underflowed chunk lengths that wrap to a large value, leading to reading beyond allocated buffers. Exploitation can cause application crashes or unintended exposure of heap memory through WildMidi_GetInfo().

libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.

LightLLM versions up to 1.2.0 have a denial of service vulnerability where unauthenticated attackers can crash the inference worker by sending crafted data to the /generate endpoint. The issue arises from deserialization failure in the internal pd_kv_trans_params field, causing the inference thread to terminate while the health endpoint remains responsive, resulting in a hang of subsequent requests until a restart occurs.

CVE-2026-111159 is a heap out-of-bounds read vulnerability in libewf, a component of the libyal project. The flaw exists in the function libewf_lef_extended_attribute_read_data() where UTF-16 name and value sizes are validated incorrectly before doubling, allowing attackers to supply crafted files with oversized extended attribute metadata. This can lead to application crashes or leakage of uninitialized heap memory. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.

EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially crashing the process.

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.

libTiMidity version 0.2.8 contains a heap out-of-bounds read vulnerability in its SoundFont loader component. This flaw arises from unvalidated sampleId and instrument generator values used as table indices, which can be triggered by loading a crafted .sf2 file via the mid_set_soundfont() function. Exploitation can lead to application crashes due to reading memory beyond allocated heap boundaries.

CVE-2026-111154 is a stack out-of-bounds write vulnerability in libTiMidity version 0.2.8 within the SoundFont loader. It occurs due to unchecked generator operators in the parse_gen function, allowing crafted .sf2 files with out-of-range operator values to corrupt stack memory. This can cause crashes and memory corruption.

Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through gme_open_data or gme_open_file, to read past the static array during loading and cause denial of service.

Game Music Emu (libgme) versions up to 0.6.5 contain a heap out-of-bounds read vulnerability in the AY loader's get_data function. This is caused by an integer underflow in the track-table bounds check. An attacker can craft a ZXAYEMUL file with an oversized track table to trigger reading beyond the file buffer, potentially causing crashes in applications using libgme.

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.

CVE-2026-111150 is a heap out-of-bounds read vulnerability in ValleyBell's libvgm library affecting version 0. It occurs in the PCM data-block decompressor due to an unbounded compression-table index, allowing crafted .vgm files to cause memory over-read and application crashes. The vulnerability has a CVSS 4.0 base score of 6.8, indicating medium severity.

FreeImage (danoli3 fork) versions up to 3.19.23 contain a heap out-of-bounds read vulnerability in the Unpack32Bits() function within PluginPICT.cpp. This occurs because the rowBytes value, controlled by the input PICT file, is not validated against the PixMap width, allowing an attacker to cause an over-read of up to 64 KiB of heap memory. This can lead to memory disclosure or application crashes when processing crafted PICT files.

CVE-2026-111147 is a heap out-of-bounds read vulnerability in libyal libesedb versions up to 0. It occurs in the function libesedb_record_get_multi_value() due to unbounded multi-value offset tables. An attacker can supply a crafted ESE/EDB database processed by esedbexport to cause a crash or read approximately 32 KiB of adjacent heap memory. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity.

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.

ytnef versions up to 2.1.2 contain a heap out-of-bounds read vulnerability in the DecompressRTF() function. This flaw occurs because the uncompressedSize for uncompressed RTF streams is not validated, allowing crafted winmail.dat TNEF attachments with malicious PT_BINARY MAPI properties to cause crashes and potentially leak adjacent heap memory.

A NULL pointer dereference vulnerability exists in libansilove versions 1.3.0 through 1.4.2 in the ansilove_xbin() function. This flaw can cause applications to crash when processing a specially crafted XBIN file that sets the 512-character flag without the custom-font flag, leading to a NULL pointer being dereferenced in drawchar().

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.

CVE-2026-111142 is an out-of-bounds read vulnerability in gdraheim zziplib versions up to 0.13.80. The flaw exists in zzip/mmapped.c and allows an attacker to craft a malicious ZIP central directory that causes the library to read beyond the allocated heap buffer. This can lead to application crashes due to memory over-read.