Skip to content

Product

debian/fluidsynth vulnerabilities

11 published CVES affecting debian/fluidsynth, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
11
Critical
1
High
4
Medium
5
Low
0
Unscored
1
CISA KEV
0

Latest debian/fluidsynth CVEs

Newest publication first

  2. CVE-2026-61720 FluidSynth: SF2 DMOD Chunk Unsigned Underflow

    Published
    MediumCVSS 6.2 EPSS 0.18%

    FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD...

  3. CVE-2026-61723 FluidSynth: DLS ptbl Chunk Integer Overflow

    Published
    MediumCVSS 6.8 EPSS 0.18%

    FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS...

  4. CVE-2026-61722 FluidSynth: DLS Articulation Chunk Integer Overflow

    Published
    MediumCVSS 6.8 EPSS 0.20%

    FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without first ensuring that the multiplication and addition fit in 32 b...

  5. CVE-2026-61714 FluidSynth: Heap Buffer Overflow in MIDI Player

    Published
    HighCVSS 7.8 EPSS 0.14%

    FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels....

  6. CVE-2026-61721 FluidSynth: Heap-based buffer overrun for DLS samples

    Published
    HighCVSS 8.0 EPSS 0.19%

    FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A cr...

  7. CVE-2026-58264 FluidSynth: Heap-based buffer overrun

    Published
    CriticalCVSS 9.8 EPSS 0.59%

    FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth cha...

  9. CVE-2025-68617 Use after free in fluidsynth

    Published
    HighCVSS 7.0 EPSS 0.21%

    FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading t...

  11. CVE-2021-21417 Use after free in fluidsynth

    Published
    MediumCVSS 5.5 EPSS 0.94%

    fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.