FluidSynth: Heap-based buffer overrun for DLS samples

published 2026-09-18 51 d ago modified 2026-09-23 46 d ago also EUVD-2026-83375

cvss: 8.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.

Patch / fix

distros 1 links 2

fluidsynth Debian 14 2.5.6+dfsg-1

debian advisories DEBIAN-CVE-2026-61721

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-61721 updated 2026-10-31 cvss 8.0

FluidSynth: FluidSynth: Memory Disclosure and Denial of Service via Crafted DLS File

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 51 d ago (2026-09-18)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.0	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Affected products

FluidSynth fluidsynth

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-125 Out-of-bounds Read

References

Sources

CVE List CVE-2026-61721
NVD CVE-2026-61721

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary