libtimidity through version 0.2.8 contains a stack out-of-bounds write in the SoundFont loader, triggered by unchecked generator operators in parse_gen. A crafted .sf2 file with out-of-range pgen/igen values can write arbitrary 16-bit data near the stack Layer object, causing crashes or corruption of stack memory. The description implies a local attack vector, but remote exploitation is not explicitly stated.

The vulnerability affects the libtimidity library (vendor sezero). Versions up to and including 0.2.8 are susceptible. No specific sub‑versions beyond 0.2.8 are listed, so all builds of libtimidity 0.2.8 and older are considered vulnerable. The product is typically used in multimedia applications that load .sf2 SoundFont files.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Attackers need to provide a malicious .sf2 file to the program; thus the likely attack vector is local file supply or local privilege escalation if the application runs with elevated rights. The stack out-of-bounds write could cause application crashes or memory corruption.