Sezero Libtimidity vulnerabilities

3 CVEs affecting Sezero Libtimidity, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-111156, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-111156, published 2026-10-15. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank…
CVE-2026-111154, published 2026-10-15. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen.…
CVE-2026-111155, published 2026-10-15. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices.…