A heap buffer overflow exists in libmt32emu before version 2.8.4, triggered when the MidiStreamParserImpl::parseSysex function processes oversized SysEx messages that exceed 32,768 data bytes and are not terminated. When the mt32emu_parse_stream API receives such a message—via a malicious MIDI file, from a MIDI port, or through a sequencer client—the library writes past the end of a heap allocation, corrupting heap memory and causing the application to crash. The vulnerability is a classic out‑of‑bounds write (CWE‑122) and is limited to causing a denial of service through application failure; no evidence of code execution is provided in the advisory.

All versions of the libmt32emu library older than 2.8.4 are vulnerable. The library is distributed by the munt organization. Users running applications that link against or otherwise use this library, such as MIDI processing tools or software that accepts MIDI input, are affected.

The CVSS score of 8.5 classifies this as high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, indicating no publicly confirmed exploits. Based on the description, it is inferred that attacks are likely local or low‑bandwidth remote if an application exposes a MIDI input interface over a network. The observed impact is a process crash; while the overflow corrupts heap memory, the advisory does not report or imply an escalation to arbitrary code execution. Defensive measures such as input validation, size limits, and patching are recommended.