libmt32emu MIDI parser heap overflow from oversized SysEx messages

Summary

The MIDI stream parser in libmt32emu writes past a heap buffer when it receives an oversized SysEx message. Versions before 2.8.4 are affected, and a malicious MIDI input can crash the program or corrupt its memory.

Affected when

• programs that feed MIDI files, ports or sequencer input through mt32emu_parse_stream

What to do

Update libmt32emu to version 2.8.4 or later.

Products and platforms

• libmt32emu

CVE IDs

• CVE-2026-121941 (opens in a new tab)

Sources

• Write-up: hackmd.io (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab) · hackmd.io (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 12:31 UTC

First seen 2026-11-09 15:20 UTC