CVE-2026-61722

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where ptbl chunk validation uses the expression cues * 4 + cbsize without checking for 32-bit overflow. A crafted DLS file can wrap the expression and pass the chunk-size check, causing poolcues.resize(cues) to request about four gigabytes and read billions of entries beyond the chunk boundary.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the SF2 parser where the DMOD modulator count is computed as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file with a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations.

FluidSynth from 2.2.4 to 2.5.6 contains a vulnerability related to configuring synth.midi-channels above 16, allowing out-of-bounds reads and writes in the _fluid_player_t::channel_isplaying structure. This can lead to undefined behavior and compromise confidentiality, integrity, or availability. The issue is fixed in version 2.5.6.

Fluidsynth version 2.4.6 and earlier is vulnerable to a null pointer dereference in fluid_synth_monopoly.c, which can be triggered when loading an invalid MIDI file.

FluidSynth from 1.1.2 to 2.5.6 has an out-of-bounds heap write vulnerability in the pitch_bend_range command handler where the channel argument is not bounds checked. This can lead to denial of service or potential code execution. The issue is remotely reachable via the TCP server or locally via the FluidSynth shell.