CVE-2026-121941 · Package
NO FIX YET · SEE WHAT TO DO
libmt32emu is a library that emulates Roland MT-32 synthesizer hardware. Oversized unterminated SysEx MIDI messages write past a heap allocation, which corrupts memory and crashes the application.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that embed libmt32emu and feed it MIDI data through the mt32emu_parse_stream API, whether from MIDI files, MIDI ports or sequencer clients. The sources describe a crash, not code execution; the sources do not say whether memory corruption can go further.
Not affected if version-2.8.4-or-later
Who cares audio, libmt32emu, midi
2.8.4 are affected.mt32emu_parse_stream calls).2.8.4 or later.libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-121941") · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.