{"id":"UBUNTU-CVE-2026-111136","details":"libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.","modified":"2026-10-17T12:58:03.906961962Z","published":"2026-10-16T00:00:00Z","upstream":["CVE-2026-111136"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-111136"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-111136"},{"type":"REPORT","url":"https://github.com/swami/libinstpatch"},{"type":"REPORT","url":"https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Gen.c#L189-L205"},{"type":"REPORT","url":"https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L1355-L1370"},{"type":"REPORT","url":"https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L954-L969"},{"type":"REPORT","url":"https://hackmd.io/@haind-pwn/libinstpatch-sf2-generator-id-oob-write"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/libinstpatch-through-1.1.7-heap-out-of-bounds-write-via-ipatch-sf2-gen-is-valid"}],"affected":[{"package":{"name":"libinstpatch","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libinstpatch?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-4"],"ecosystem_specific":{"binaries":[{"binary_version":"1.0.0-4","binary_name":"libinstpatch-1.0-0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111136.json"}},{"package":{"name":"libinstpatch","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libinstpatch?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-6","1.0.0-7"],"ecosystem_specific":{"binaries":[{"binary_version":"1.0.0-7","binary_name":"libinstpatch-1.0-0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111136.json"}},{"package":{"name":"libinstpatch","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libinstpatch?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-7","1.1.2-2","1.1.2-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libinstpatch-1.0-2","binary_version":"1.1.2-2build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111136.json"}},{"package":{"name":"libinstpatch","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libinstpatch?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.6-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libinstpatch-1.0-2","binary_version":"1.1.6-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111136.json"}},{"package":{"name":"libinstpatch","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libinstpatch?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.6-1","1.1.6-1build1","1.1.6-1build2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.1.6-1build2","binary_name":"libinstpatch-1.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111136.json"}},{"package":{"name":"libinstpatch","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/libinstpatch?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7-1.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.1.7-1.1","binary_name":"libinstpatch-1.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111136.json"}},{"package":{"name":"libinstpatch","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libinstpatch?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.6-1build2","1.1.7-1.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.1.7-1.1","binary_name":"libinstpatch-1.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111136.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}