CVE-2026-111161

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111161

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111161.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111161

Published

2026-10-15T18:57:49Z

Modified

2026-10-17T07:04:55Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates

Details

libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111161.json"
}

References

Affected packages

Git / github.com/wohlstand/libadlmidi

Affected ranges

Type

GIT

Repo

https://github.com/wohlstand/libadlmidi

Events

Introduced

ef8ed009aa0d3ef32affe3813a2552e5f60249e6

Fixed

99c5e03a5cf9b4fdf35b53efddb853c96320d50f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.6.2"
        },
        {
            "last_affected":  "1.6.2.1"
        },
        {
            "fixed":  "1.6.2.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v1.*

v1.6.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111161.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "140976802873806784266399660296035173062",
                "158524881095113783151323007419147765144",
                "299767557556012299399617285950908105718",
                "339440996322695278182285466362524035766",
                "123707171473377661378713781851226846026",
                "72045799197457671106981094639439868089"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111161-362edfec",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/wohlstand/libadlmidi/commit/99c5e03a5cf9b4fdf35b53efddb853c96320d50f",
        "target":  {
            "file":  "include/adlmidi.h"
        }
    }
]

vanir_signatures_modified

"2026-10-17T07:04:55Z"