Bug 2573058

Summary: CVE-2026-128845 timidity++: TiMidity++: stack buffer overwrite in XG SysEx bulk dump parsing (parse_sysex_event_multi) [fedora-all]
Product: [Fedora] Fedora Reporter: Michal Findra <mfindra>
Component: timidity++Assignee: Hans de Goede <hans>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: chkr, hans, jnovy
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["f613b77e-e959-4036-a1ae-001c70ed1525"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2573057    

Description Michal Findra 2026-11-13 10:10:45 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A stack buffer overwrite was reported in TiMidity++ (external researcher report via PSIRTSUPT-30234; report and patch at https://gist.github.com/DicksonWu654/1cde815f70eaeb3c2c52b4801b80e09b). read_sysex_event() passes a stack array MidiEvent evm[260] to parse_sysex_event_multi() (timidity/readmidi.c:3261,3283 in 2.15.0). The XG bulk dump loops in that function (Effect 1 around line 798, Effect 2 around line 994, Multi Part around line 1038) add one event per SysEx body byte with no bound on the event count; the Effect 2 loop writes evm[num_events++] unconditionally for every body byte. A SysEx message with more than about 260 body bytes in a .mid file therefore writes past the end of evm. Opening or converting a crafted .mid file is sufficient to trigger it.

Verified in TiMidity++ 2.15.0 (last upstream release, 2018; upstream is unmaintained). Packaged builds abort with stack smashing detected (__stack_chk_fail); the reporter demonstrated a reliable crash (20/20) on Debian 2.14.0-8.5, Ubuntu 2.14.0-8.2ubuntu1 and Fedora 2.15.0-17.fc45, and no crash with the suggested bound-check patch. Only a crash is demonstrated, not code execution; the file controls part of the written bytes. Suggested severity: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5).

Red Hat exposure (newcli): timidity++ 2.15.0 ships in Fedora 43 (2.15.0-15.fc43), Fedora 44 (2.15.0-16.fc44) and Fedora rawhide (2.15.0-17.fc45) only. Not shipped in RHEL or EPEL. libtimidity (EPEL 8, Fedora) is based on timidity-0.2i and does not contain parse_sysex_event_multi - not affected.

Suggested fix: bound the XG bulk dump loops before evm fills (patch in the gist above). CVE ID to be assigned.