CVE-2026-61723

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.

Security Fix(es):

A heap-based buffer overflow was discovered in fluidsynth's MIDI player. When the synth is configured with synth.midi-channels > 16 an out-of-bounds memory access is performed on the array _fluid_player_t::channel_isplaying in heap memory invoking undefined behavior. No crafted MIDI file is required to expose this vulnerability.(CVE-2026-61714)

An unsigned integer overflow in fluidsynth's SF2 parser was discovered. The DMOD chunk handler calculates modulator count as chunk.size / SF_MOD_SIZE - 1. When chunk.size = 0, the division yields 0 and the unsigned subtraction wraps to UINT_MAX (4,294,967,295). The guard check passes because 0 % 10 == 0. The loop iterates billions of times, allocating an SFMod struct per iteration until causing a denial of service via out-of-memory.(CVE-2026-61720)

Fluidsynth's native DLS loader sets sample loop points from file-sourced wsmp.loop_start and wsmp.loop_length values without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). Crafted DLS files with loop values exceeding the sample buffer cause out-of-bounds reads during audio rendering, invoking undefined behavior and denial of service.(CVE-2026-61721)

An integer overflow was discovered in fluidsynth's native DLS parser. The expression cbsize + connblocks * 12 overflows for connblocks = 0x40000001. The loop reads 12 bytes per iteration for ~1 billion iterations (~12.8 GB total) past the chunk boundary.(CVE-2026-61722)

An integer overflow was discovered in fluidsynth's native DLS parser. The ptbl chunk validation uses uint32_t arithmetic: cues * 4 + cbsize != subchunk.size. For cues = 0x40000002 and cbsize = 8, the multiplication overflows: 0x40000002 * 4 = 0x100000008, truncated to 0x8. The check 8 + 8 = 16 == subchunk.size passes. The subsequent poolcues.resize(cues) attempts a ~4GB allocation, and the loop reads billions of entries past the file's chunk boundary.(CVE-2026-61723)

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.