FormatoKit parses files from instruments and from other people, so a crafted file that crashes a reader, reads past the end of a buffer or uses unbounded memory is a security issue.

Please report it privately with GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. Please do not open a public issue for it. Include the FormatoKit version, the format and, if you can, a file that reproduces the problem.

Fixes are made on a best-effort basis and released in the next version.

Only the latest release receives fixes.