CVE-2017-11661

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.07.5High EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2017-08-17Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your systems use wildmidi 0.4.2, especially where MIDI files are uploaded, received, or processed.
Ask your software vendor or IT provider whether they have an updated wildmidi release that addresses CVE-2017-11661; no fixed version is currently available in the findings.
Until an update is confirmed, block or isolate MIDI files from untrusted sources before they reach affected software.
Watch for repeated crashes when opening or processing MIDI files, and preserve the affected files for investigation.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.

In plain language

Written by AI from the record

wildmidi 0.4.2 can be crashed by a specially made MIDI file, so businesses that process untrusted MIDI files should take action.

CWE-125 invalid memory read in wildmidi's _WM_SetupMidiEvent permits denial of service when parsing a crafted MIDI file.

If you're affected

Application crashes
Interrupted media processing
Service outages
Operational disruption

What is it

This is a flaw in software that reads MIDI music files. A malicious MIDI file can act like a damaged instruction card that makes the receiving application stop working instead of handling the file safely.

Who is affected

This matters to you if you use or run wildmidi to play, convert, inspect, or otherwise process MIDI files. It is most relevant where wildmidi handles files supplied by customers, partners, downloads, or other untrusted sources.

How urgent is it

Attackers can use a specially made MIDI file to crash affected software, and a public exploit is available. This is an amber issue: prioritise it for systems that accept outside MIDI files, while confirming whether your software provider has a supported update.

What to do — in detail

Confirm whether wildmidi 0.4.2 is installed directly or bundled inside another application, then identify every workflow that parses externally supplied .mid files. No fixed release or supported upgrade target is provided in the available patch information, so contact the application or package vendor for a remediated build before changing versions.

If patching is delayed, prevent untrusted MIDI files from reaching the affected parser: reject uploads where possible, scan and quarantine incoming files, and process necessary files in an isolated service with restart controls. Monitor application crash logs and unusual bursts of MIDI-file processing; retain suspicious files and relevant logs for investigation. CISA has not listed this CVE in its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies.

Technical context

CVE-2017-11661 is rated CVSS 7.5 (High): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The reported weakness is CWE-125, an out-of-bounds/invalid memory read in _WM_SetupMidiEvent in internal_midi.c, triggered by a crafted MIDI file and resulting in denial of service through an application crash. A public exploit is known to be available. EPSS predicts an 8.9% likelihood (95th percentile) and is flat; this is predictive only. The CVE is not in CISA KEV, and there is no confirmation in the findings of active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3324 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

mindwerksoss-project
- wildmidiOn-premConsumer Software / media-player

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable