Heap Out-of-Bounds Read in WildMIDI

Executive Summary

CVE-2026-111163 is a heap out-of-bounds read vulnerability in WildMIDI through version 0.5.0. It occurs in the _WM_ParseNewHmi() function in src/f_hmi.c when handling 0xfe sub-events. Attackers can craft a malicious HMI file with a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocated memory, causing the application to crash during decoding.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect WildMIDI versions up to 0.5.0 for crashes when processing HMI files. Check logs for heap out-of-bounds read errors in _WM_ParseNewHmi(). Use static analysis tools to scan src/f_hmi.c for improper buffer handling near 0xfe sub-events.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using WildMIDI to crash when processing specially crafted HMI files. While it does not directly allow code execution, repeated crashes could lead to denial-of-service conditions. The impact depends on whether the vulnerable application processes untrusted files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical flaw in the WildMIDI library causing crashes due to heap out-of-bounds reads. However, if exploited, it could lead to denial of service or potential arbitrary code execution, which may indirectly impact systems processing sensitive data under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade WildMIDI to the latest version beyond 0.5.0. Disable parsing of HMI files if not required. Apply input validation to reject malformed HMI files. Monitor for crashes in WildMIDI applications.

Useful 0 Not Useful 0