WildMIDI versions up to 0.5.0 contain a heap out‑of‑bounds read in the HMP parser function _WM_ParseNewHmp. Based on the description, it is inferred that attackers can supply a crafted .hmp file with a chunk length of 0‑12 that wraps to roughly 4 GB, which when processed by WildMIDI can trigger a crash or allow reading arbitrary heap bytes through WildMidi_GetInfo(). The flaw is a classic CWE‑125 underflow read; it can expose sensitive data only if the memory contents are valuable, but it does not provide write access or privilege escalation.

The affected product is Mindwerks WildMIDI, version 0.5.0. No other versions are listed as affected, so the vulnerability scope is limited to installations that have not applied a newer release that patches the _WM_ParseNewHmp parsing routine.

The CVSS score of 6.9 indicates a moderate severity impact. The EPSS score of less than 1% shows a very low probability of exploitation in the wild, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need local or remote access to supply a malicious .hmp file that WildMIDI processes; the read vulnerability could cause a crash or leak heap data but does not provide arbitrary code execution. Therefore the risk to systems is moderate but likely low in real‑world scenarios unless the file is handled automatically by a potentially trusted process.