CVE-2026-111136

Deferred Deferred - Pending Action

Heap Out-of-Bounds Write in libInstPatch SoundFont 2 Loader

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111136

EUVD

EUVD-2026-102263

Affected Vendors & Products

Vendor	Product	Version / Range
swami	libinstpatch	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap out-of-bounds write flaw in libInstPatch versions up to 1.1.7. It occurs in the SoundFont 2 loader when processing generator IDs. The function ipatch_sf2_gen_is_valid fails to validate generator IDs before performing a bit shift operation. Attackers can craft SF2 files with out-of-range generator IDs (0-65535) that bypass validation due to hardware-specific behavior, allowing writes to heap memory outside intended bounds. This corrupts memory and can crash applications like Swami.

Detection Guidance

To detect this vulnerability, inspect systems running libInstPatch versions up to 1.1.7 for applications processing SoundFont files. Check for crashes or memory corruption when loading SF2 files. Monitor logs for heap-related errors or segmentation faults during SoundFont file parsing.

Impact Analysis

This vulnerability allows attackers to crash applications using libInstPatch, such as Swami, by providing malicious SoundFont files. It may lead to denial of service or potentially arbitrary code execution. Exploitation requires user interaction to load a crafted file but no special privileges. Systems processing untrusted SoundFont files are at risk.

Compliance Impact

This vulnerability primarily affects software integrity and availability by enabling heap corruption through crafted SoundFont files. While it does not directly expose personal data, it could lead to denial-of-service conditions or arbitrary code execution in applications processing untrusted files. Compliance impact depends on the application context: for GDPR, it may violate integrity requirements if processing integrity is compromised; for HIPAA, it could affect availability of systems handling protected health information if exploited to crash software.

Mitigation Strategies

Update libInstPatch to the latest version that includes the fix for generator ID validation.
Avoid loading untrusted SoundFont files until the library is updated.
Implement file integrity checks for SoundFont files before processing.

Hi! I’m here to help you understand CVE-2026-111136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70