CVE-2026-61714

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.

Security Fix(es):

A heap-based buffer overflow was discovered in fluidsynth's MIDI player. When the synth is configured with synth.midi-channels > 16 an out-of-bounds memory access is performed on the array _fluid_player_t::channel_isplaying in heap memory invoking undefined behavior. No crafted MIDI file is required to expose this vulnerability.(CVE-2026-61714)

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.

Security Fix(es):

A heap-based buffer overflow was discovered in fluidsynth's MIDI player. When the synth is configured with synth.midi-channels > 16 an out-of-bounds memory access is performed on the array _fluid_player_t::channel_isplaying in heap memory invoking undefined behavior. No crafted MIDI file is required to expose this vulnerability.(CVE-2026-61714)

An unsigned integer overflow in fluidsynth's SF2 parser was discovered. The DMOD chunk handler calculates modulator count as chunk.size / SF_MOD_SIZE - 1. When chunk.size = 0, the division yields 0 and the unsigned subtraction wraps to UINT_MAX (4,294,967,295). The guard check passes because 0 % 10 == 0. The loop iterates billions of times, allocating an SFMod struct per iteration until causing a denial of service via out-of-memory.(CVE-2026-61720)

Fluidsynth's native DLS loader sets sample loop points from file-sourced wsmp.loop_start and wsmp.loop_length values without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). Crafted DLS files with loop values exceeding the sample buffer cause out-of-bounds reads during audio rendering, invoking undefined behavior and denial of service.(CVE-2026-61721)

An integer overflow was discovered in fluidsynth's native DLS parser. The expression cbsize + connblocks * 12 overflows for connblocks = 0x40000001. The loop reads 12 bytes per iteration for ~1 billion iterations (~12.8 GB total) past the chunk boundary.(CVE-2026-61722)

An integer overflow was discovered in fluidsynth's native DLS parser. The ptbl chunk validation uses uint32_t arithmetic: cues * 4 + cbsize != subchunk.size. For cues = 0x40000002 and cbsize = 8, the multiplication overflows: 0x40000002 * 4 = 0x100000008, truncated to 0x8. The check 8 + 8 = 16 == subchunk.size passes. The subsequent poolcues.resize(cues) attempts a ~4GB allocation, and the loop reads billions of entries past the file's chunk boundary.(CVE-2026-61723)

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.

Security Fix(es):

A heap-based buffer overflow was discovered in fluidsynth's MIDI player. When the synth is configured with synth.midi-channels > 16 an out-of-bounds memory access is performed on the array _fluid_player_t::channel_isplaying in heap memory invoking undefined behavior. No crafted MIDI file is required to expose this vulnerability.(CVE-2026-61714)

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.

It was discovered that FluidSynth did not properly validate the channel argument of the pitch_bend_range command. A remote attacker could possibly use this issue to cause FluidSynth to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-58264)

It was discovered that FluidSynth incorrectly handled configurations with more than 16 MIDI channels in its MIDI player, leading to a heap buffer overflow. An attacker could possibly use this issue to cause FluidSynth to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61714)