Bug 2573057 (CVE-2026-128845)

Summary:	CVE-2026-128845 timidity++: TiMidity++: stack buffer overwrite in XG SysEx bulk dump parsing (parse_sysex_event_multi)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in TiMidity++. An attacker could exploit this vulnerability by tricking a user into opening or converting a specially crafted MIDI audio file with oversized System Exclusive (SysEx) messages. Due to missing bounds checks during message processing, this issue causes a stack-based buffer overflow, resulting in an application crash and leading to a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2573058
Bug Blocks:

Description OSIDB Bzimport 2026-11-13 10:07:39 UTC

A stack buffer overwrite was reported in TiMidity++ (external researcher report via PSIRTSUPT-30234; report and patch at https://gist.github.com/DicksonWu654/1cde815f70eaeb3c2c52b4801b80e09b). read_sysex_event() passes a stack array MidiEvent evm[260] to parse_sysex_event_multi() (timidity/readmidi.c:3261,3283 in 2.15.0). The XG bulk dump loops in that function (Effect 1 around line 798, Effect 2 around line 994, Multi Part around line 1038) add one event per SysEx body byte with no bound on the event count; the Effect 2 loop writes evm[num_events++] unconditionally for every body byte. A SysEx message with more than about 260 body bytes in a .mid file therefore writes past the end of evm. Opening or converting a crafted .mid file is sufficient to trigger it.

Verified in TiMidity++ 2.15.0 (last upstream release, 2018; upstream is unmaintained). Packaged builds abort with stack smashing detected (__stack_chk_fail); the reporter demonstrated a reliable crash (20/20) on Debian 2.14.0-8.5, Ubuntu 2.14.0-8.2ubuntu1 and Fedora 2.15.0-17.fc45, and no crash with the suggested bound-check patch. Only a crash is demonstrated, not code execution; the file controls part of the written bytes. Suggested severity: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5).

Red Hat exposure (newcli): timidity++ 2.15.0 ships in Fedora 43 (2.15.0-15.fc43), Fedora 44 (2.15.0-16.fc44) and Fedora rawhide (2.15.0-17.fc45) only. Not shipped in RHEL or EPEL. libtimidity (EPEL 8, Fedora) is based on timidity-0.2i and does not contain parse_sysex_event_multi - not affected.

Suggested fix: bound the XG bulk dump loops before evm fills (patch in the gist above). CVE ID to be assigned.