Description
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| swami | libinstpatch | ≤ 1.1.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libinstpatch | 1.1.8-1 | — |
| Debian 13 | libinstpatch | No fix yet | — |
| Debian 12 | libinstpatch | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libinstpatch | No fix yet | — |
| Ubuntu 26.04 LTS | libinstpatch | No fix yet | — |
| Ubuntu 24.04 LTS | libinstpatch | No fix yet | — |
| Ubuntu 22.04 LTS | libinstpatch | No fix yet | — |
| Ubuntu 20.04 LTS | libinstpatch | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libinstpatch | No fix yet | — |
| Ubuntu 16.04 LTS | libinstpatch | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libinstpatch | 1.1.8-1.1 | openSUSE-SU-2026:12199-1 |
Advisories 1
- openSUSE-SU-2026:12199-1 libinstpatch-1_0-2-1.1.8-1.1 on GA media SUSE / openSUSE Security Updates · Oct 21, 2026
References
- https://hackmd.io/@haind-pwn/libinstpatch-sf2-generator-id-oob-write technical-description
- https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Gen.c#L189-L205 technical-description
- https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L1355-L1370 technical-description
- https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L954-L969 technical-description
- https://github.com/swami/libinstpatch product
- VulnCheck Advisory: libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid third-party-advisory