CVE-2026-111136
libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.
| CWE | CWE-787 |
| Vendor | swami |
| Product | libinstpatch |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for swami libinstpatch
Be the first to know when new medium vulnerabilities affecting swami libinstpatch are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
swami / libinstpatch
0 ≤ 1.1.7
References
hackmd.io: https://hackmd.io/@haind-pwn/libinstpatch-sf2-generator-id-oob-write github.com: https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Gen.c#L189-L205 github.com: https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L1355-L1370 github.com: https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L954-L969 github.com: https://github.com/swami/libinstpatch vulncheck.com: https://www.vulncheck.com/advisories/libinstpatch-through-1.1.7-heap-out-of-bounds-write-via-ipatch-sf2-gen-is-valid
Credits
HaiND from the Post and Telecommunication Institute of Technology