CVE-2026-58264
CriticalCVSS 9.8Summary
FluidSynth from 1.1.2 to 2.5.6 has an out-of-bounds heap write vulnerability in the pitch_bend_range command handler where the channel argument is not bounds checked. This can lead to denial of service or potential code execution. The issue is remotely reachable via the TCP server or locally via the FluidSynth shell.
Risk Assessment
An attacker can crash the application or execute arbitrary code on the server, potentially leading to system compromise or service disruption.
Recommendation
Upgrade FluidSynth to version 2.5.6 or later. If not possible, disable the TCP server and avoid passing untrusted data to the shell.
Other vulnerabilities in FluidSynth
See all- CVE-2026-61723Medium
FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where ptbl chunk validation uses the expression cues * 4 + cbsize without checking for 32-bit overflow. A crafted DLS file can wrap the expression and pass the chunk-size check, causing poolcues.resize(cues) to request about four gigabytes and read billions of entries beyond the chunk boundary.
- CVE-2026-61722Medium
FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where articulation chunk validation uses the expression cbsize + connblocks * 12 without checking for 32-bit overflow. A crafted DLS file can wrap the expression and bypass the chunk-size check, leading to approximately one billion 12-byte iterations beyond the chunk boundary.
- CVE-2026-61721High
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering.
- CVE-2026-61720Medium
FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the SF2 parser where the DMOD modulator count is computed as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file with a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations.
- CVE-2026-61714High
FluidSynth from 2.2.4 to 2.5.6 contains a vulnerability related to configuring synth.midi-channels above 16, allowing out-of-bounds reads and writes in the _fluid_player_t::channel_isplaying structure. This can lead to undefined behavior and compromise confidentiality, integrity, or availability. The issue is fixed in version 2.5.6.
- CVE-2025-56225High
Fluidsynth version 2.4.6 and earlier is vulnerable to a null pointer dereference in fluid_synth_monopoly.c, which can be triggered when loading an invalid MIDI file.
Original NVD description (English source)
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.