libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111136 · Microsoft / collected KEV context

cve-program · CVE-2026-111136

• https://hackmd.io/@haind-pwn/libinstpatch-sf2-generator-id-oob-write
• https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Gen.c#L189-L205
• https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L1355-L1370
• https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L954-L969
• https://github.com/swami/libinstpatch
• https://www.vulncheck.com/advisories/libinstpatch-through-1.1.7-heap-out-of-bounds-write-via-ipatch-sf2-gen-is-valid

No related operational record is retained in the current change model.