libTimidity up to version 0.2.8 contains a heap out‑of‑bounds read (CWE‑125) in the SoundFont loader. The vulnerability allows an attacker to supply a crafted .sf2 file that is processed by mid_set_soundfont(), resulting in reading memory beyond the bounds of a target buffer and potentially exposing private data on the heap. The defect may also lead to application crashes, causing a denial of service for legitimate users.

The library sezero:libtimidity is affected. All releases through and including version 0.2.8 – that is, 0.2.8 and earlier – are vulnerable. No later releases are known to contain this issue.

The CVSS score of 6.9 denotes a moderate severity vulnerability. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation observed in the wild, and the entry is not listed in the CISA KEV catalog. The attack vector is local; an adversary can trick the application into loading a malicious .sf2 file, either by instructing a user or by placing the file where the application automatically loads it. Because the flaw requires the ability to introduce a crafted file, it is not remotely exploitable without additional influence over the file system or user input.