CVE-2017-11661
HighSummary
The _WM_SetupMidiEvent function in internal_midi.c in WildMIDI 0.4.2 can lead to denial of service through invalid memory reads and application crashes when processing a crafted MIDI file.
Risk Assessment
The organization may experience application downtime, potentially leading to loss of availability of services related to MIDI file processing.
Recommendation
It is recommended to update to a newer version of WildMIDI to mitigate this vulnerability and to monitor the application for abnormal behavior.
Other vulnerabilities in WildMIDI 0.4.2
See all- CVE-2017-11662High
The _WM_ParseNewMidi function in f_midi.c in WildMIDI 0.4.2 can lead to denial of service through invalid memory read and application crash when processing a crafted mid file.
- CVE-2026-111163Medium
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.
- CVE-2026-111162Medium
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().
Original NVD description (English source)
The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS