libmt32emu: Heap buffer overflow in MidiStreamParserImpl::parseSysex (CVE-2026-121941)
A heap-based buffer overflow in libmt32emu allows attackers to corrupt heap memory and crash the application by supplying SysEx messages exceeding 32,768 bytes.
CVE search metadata
CVE search record: CVE-2026-121941. Severity: high. CVSS: 7.8. KEV: no. Product: libmt32emu (< 2.8.4). Brief: libmt32emu: Heap buffer overflow in MidiStreamParserImpl::parseSysex (CVE-2026-121941). Brief link: https://feed.craftedsignal.io/briefs/2026-11-libmt32emu-heap-overflow/
Triage facts
Revision 1- Applicability
- libmt32emu (< 2.8.4)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 16:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The libmt32emu library before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex. Attackers can write past a heap allocation by supplying oversized, unterminated SysEx messages exceeding 32,768 bytes. This data can be fed through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients, resulting in heap memory corruption and application crashes.