libInstPatch 1.1.7 and earlier contain a heap out‑of‑bounds write due to missing range checks on generator IDs in the SoundFont 2 loader. An attacker who supplies a crafted SF2 file can cause the loader to overwrite memory past the zone genarray, corrupting heap data and triggering a crash or, if the corrupted data is used in subsequent sensitive operations, potentially leading to arbitrary code execution. The vulnerability allows an attacker to influence the contents of the corrupted heap, but the description does not confirm remote code execution, only memory corruption and denial of service. The weakness is a classic buffer overrun (CWE‑787).

The affected product is Swami’s libInstPatch, version 1.1.7 and all earlier releases. Any consumer that loads SF2 files with this library, including Swami itself and other applications that embed libInstPatch, is at risk. No specific operating system or platform is mentioned; the issue exists in the library’s source code on all supported platforms.

The CVSS score of 6.9 indicates medium severity. The EPSS score of less than 1 % suggests the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local or privileged attacker who can supply a maliciously crafted SF2 file to an application that uses libInstPatch. Because memory corruption can cause a crash, the most immediate threat is denial of service, though the ability to write arbitrary data raises concerns about potential escalation or abuse if the corrupted memory is later used in a critical context.