Heap Buffer Overflow in Munt MIDI Library (CVE-2026-121941)
Article Content
- •CVE-2026-121941 affects libmt32emu versions before 2.8.4, allowing heap buffer overflow.
- •Attackers can exploit oversized SysEx messages to corrupt memory and crash applications.
- •Immediate upgrade to version 2.8.4 is recommended to mitigate this vulnerability.
A heap buffer overflow vulnerability (CVE-2026-121941) has been identified in the libmt32emu library, affecting versions prior to 2.8.4. This flaw allows attackers to exploit oversized unterminated SysEx messages, potentially leading to application crashes or memory corruption. The vulnerability is present in the MidiStreamParserImpl::parseSysex function, which does not properly limit the size of incoming data. Affected systems include workstations and services running MIDI sequencers, synthesizer emulators, and games that utilize this library. While a proof-of-concept exists, there are currently no reports of active exploitation. Users are advised to upgrade to version 2.8.4 or later to mitigate the risk. Until then, blocking untrusted MIDI files and restricting MIDI stream sources is recommended.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track CVE-2026-121941 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of libmt32emu are affected?
Is there a patch available?
What should I do if I can't upgrade immediately?
Continue Reading
Critical RCE Flaws in Linux KSMBD Disclosed On October 21-22, 2026, Trend Micro's Zero Day Initiative disclosed two critical remote code execution vulnerabilities in the Linux kernel's KSMBD SMB server, both rated CVSS 9.0. The vulnerabilities, ZDI-CAN-33774 and ZDI-CAN-33549, have not been assigned CVE identifiers as no mainline kernel fixes exist yet.…