CVE-2026-111136
libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid
swami libinstpatch
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.
Text from CVE List
Affected versions 1
- libinstpatchaffected: all versions through 1.1.7CVE List
References 6
- vulncheck.com/advisories/libinstpatch-through-1.1.7-heap-out-of-bounds-write-via-ipatch-sf2-gen-is-validAdvisoryvia CVE List
- hackmd.io/@haind-pwn/libinstpatch-sf2-generator-id-oob-writeExploitvia CVE List
- github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Gen.c#L189-L205Referencevia CVE List
- github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L1355-L1370Referencevia CVE List
- github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L954-L969Referencevia CVE List
- github.com/swami/libinstpatchReferencevia CVE List