The vulnerability is an off‑by‑one stack out‑of‑bounds write in the BW_MidiSequencer component of libADLMIDI. A specially crafted MIDI file that includes a note‑on event with status byte 0x9F and note value 0x7F can corrupt stack memory when processed by adl_openFile() or adl_openData(). The corrupted stack may lead to a crash of the host application or, in the worst case, other unexpected behavior.

The flaw affects libADLMIDI version 1.6.2 through 1.6.2.1, provided by Wohlstand. The library is typically embedded in media players and game engines that load user supplied MIDI files, so any host application that depends on these library versions is at risk.

With a CVSS score of 6.9 the vulnerability is considered moderate, and an EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, suggesting no known widespread attacks. The likely attack vector requires an adversary to supply a malicious MIDI file to the target application, which can be done locally or when the application loads untrusted files. Appropriate bounds checking would mitigate the vulnerability.