WildMIDI up to version 0.5.0 contains a heap read bug in the function _WM_ParseNewHmi() inside the source module f_hmi.c. When a 0xfe sub‑event is processed the code reads up to four bytes past the intended buffer boundary. The read can surface sensitive information that resides immediately after the allocated space, and the overflow also increases the risk of a crash during parsing. The flaw is a classic out‑of‑bounds read (CWE‑125) and does not directly enable code execution, but it can lead to denial of service or unintended information disclosure.

The vulnerability affects the Mindwerks WildMIDI product at version 0.5.0 and earlier. No other product versions have been reported as affected.

The CVSS score of 6.8 indicates a moderate severity, while the EPSS score of less than 1% shows a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires the attacker to supply a specially crafted HMI file containing a 0xfe 0x10 sub‑event positioned near a buffer boundary. The attack vector is therefore a local or remote file ingestion scenario where the decoder processes user‑supplied input.