CVE-2026-111163 in WildMIDI
Summary
by MITRE • 10/15/2026
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in WildMIDI versions through 0.5.0 represents a critical memory safety flaw located within the MIDI file parsing logic, specifically inside the _WM_ParseNewHmi function found in the src/f_hmi.c source module. This component is responsible for handling Meta Event messages (HMIs) which are essential for defining tempo changes, lyrics, and other metadata within Standard MIDI Files. The core technical defect arises from an improper boundary check when processing sub-events that carry a type identifier of 0xfe. Under normal operational conditions, the parser correctly iterates through these events to extract relevant data structures. However, due to insufficient validation of buffer lengths relative to the current read pointer, the application fails to account for cases where a specific sequence of bytes indicates a 0xfe sub-event with a value of 0x10 positioned near the physical end of the allocated memory buffer.
When an attacker supplies a maliciously crafted HMI file containing this specific configuration, the parser attempts to access data beyond the limits of the heap-allocated buffer. This results in a heap out-of-bounds read operation where up to four bytes are accessed from unallocated or adjacent memory regions outside the intended scope. While the immediate observable effect is often a segmentation fault leading to application crash, this type of vulnerability falls under CWE-125: Out-of-bounds Read. The ability to read arbitrary memory contents can potentially expose sensitive information such as stack pointers, heap metadata, or other process data depending on what resides in adjacent memory at the time of exploitation. This aligns with ATT&CK technique T1083, which covers File and Directory Discovery, although in this context it is primarily a denial-of-service vector rather than an active exfiltration mechanism unless combined with further exploitation techniques like information disclosure via side channels or subsequent writes if the vulnerability were writable.
The operational impact of this flaw is significant for any service or application that integrates WildMIDI to render MIDI audio content, particularly in web-based environments where users can upload custom sound files. A successful exploit allows an attacker to cause a denial-of-service condition by crashing the decoding process. In server-side deployments, repeated crashes could lead to resource exhaustion if automatic restarts are configured without proper health checks or rate limiting. Furthermore, because heap corruption often destabilizes memory management structures, there is a theoretical risk that this out-of-bounds read could be leveraged in more complex attack chains involving information leakage or potentially influencing subsequent allocation behaviors, although the primary classification remains an out-of-bounds read rather than a write vulnerability.
Mitigation strategies should prioritize immediate patching to versions of WildMIDI later than 0.5.0 where this boundary check has been corrected by the maintainers. For environments that cannot immediately upgrade, input validation at the ingestion layer is critical. Security gateways or proxy servers handling MIDI file uploads should inspect incoming files for malformed structures and reject those containing suspicious meta-event sequences near buffer boundaries. Additionally, enabling Address Sanitizer (ASan) during development builds can help detect such memory errors early in the software lifecycle. Organizations relying on WildMIDI should also implement robust error handling to ensure that crashes do not propagate up to higher-level application logic or expose stack traces to end users, thereby limiting the information available for further exploitation attempts.