CVE-2026-111161 in libADLMIDI
Summary
by MITRE • 10/15/2026
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in libADLMIDI versions 1.6.2 through 1.6.2.1 represents a critical stack-based buffer overflow, specifically categorized as an off-by-one error within the BW_MidiSequencer component. This flaw arises from improper boundary checking during the processing of MIDI data structures, allowing for memory corruption when specific conditions are met in the input stream. The root cause lies in the arithmetic logic used to calculate array indices or pointer offsets relative to stack-allocated buffers. When a crafted MIDI file is processed, the sequencer fails to validate that the calculated index remains within the allocated bounds of the destination buffer, resulting in a write operation that exceeds the intended memory region by exactly one byte or more depending on subsequent processing steps. This type of vulnerability falls under CWE-193, which defines off-by-one errors leading to memory corruption, and is often associated with CWE-787, an out-of-bounds write condition.
The exploitation vector for this vulnerability involves the injection of a specifically crafted MIDI file containing a note-on event with status byte 0x9F and note value 0x7F. The adl_openFile() or adl_openData() functions serve as the entry points where this malicious data is ingested into the application's memory space. Upon parsing these specific bytes, the internal sequencer logic triggers the flawed calculation path in BW_MidiSequencer. Because the overflow occurs on the stack, it directly impacts critical control flow data such as return addresses or saved frame pointers stored adjacent to local variables. This proximity allows an attacker to potentially overwrite function return addresses with arbitrary values, thereby gaining control over program execution flow. In many practical scenarios involving media players and game engines that rely heavily on audio processing libraries like libADLMIDI, the immediate observable impact is a segmentation fault or application crash due to memory access violations triggered by the corrupted stack state.
From an operational perspective, this vulnerability poses significant risks to applications integrating libADLMIDI for sound synthesis. For end-users, encountering such a crafted MIDI file can lead to denial of service through application crashes, disrupting workflow in digital audio workstations, game engines, or standalone media players. However, the severity extends beyond simple availability issues because stack-based buffer overflows are historically among the most exploitable vulnerability classes for remote code execution if additional protections like ASLR and DEP are bypassed or misconfigured. The ATT&CK framework classifies this behavior under Tactic Execution (TA0002) with techniques related to Command and Scripting Interpreter abuse, specifically leveraging input validation failures to execute arbitrary commands via memory corruption. Attackers could potentially leverage this flaw in scenarios where the application processes untrusted audio assets from external sources, such as user-generated content platforms or online multiplayer games that allow custom sound packs.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade libADLMIDI to a version greater than 1.6.2.1 where the boundary checks in BW_MidiSequencer have been corrected to ensure all array accesses remain within allocated limits. Developers integrating this library should also implement input validation layers that sanitize MIDI files before they reach the sequencer, checking for anomalous status and note values such as the specific 0x9F/0x7F combination identified in the exploit path. Furthermore, enabling compiler-level security features like stack canaries (-fstack-protector), Address Space Layout Randomization (ASLR), and Data Execution Prevention (DEP) provides essential layers of defense that mitigate the impact of memory corruption vulnerabilities by making exploitation significantly more difficult even if a flaw exists. Regular static analysis using tools configured to detect CWE-193 patterns can help identify similar off-by-one errors in custom MIDI parsing logic before deployment.