FluidSynth vulnerabilities

Products

• fluidsynth 10

Latest FluidSynth CVEs

Newest publication first

1. CVE-2026-111123 FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination

   Published 2026-10-15

   Medium·CVSS 6.9 EPSS 0.19%

   FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loade...

2. CVE-2026-61720 FluidSynth: SF2 DMOD Chunk Unsigned Underflow

   Published 2026-09-18

   Medium·CVSS 6.2 EPSS 0.18%

   FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD...

3. CVE-2026-61723 FluidSynth: DLS ptbl Chunk Integer Overflow

   Published 2026-09-18

   Medium·CVSS 6.8 EPSS 0.18%

   FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS...

4. CVE-2026-61722 FluidSynth: DLS Articulation Chunk Integer Overflow

   Published 2026-09-18

   Medium·CVSS 6.8 EPSS 0.20%

   FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without first ensuring that the multiplication and addition fit in 32 b...

5. CVE-2026-61714 FluidSynth: Heap Buffer Overflow in MIDI Player

   Published 2026-09-18

   High·CVSS 7.8 EPSS 0.14%

   FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels....

6. CVE-2026-61721 FluidSynth: Heap-based buffer overrun for DLS samples

   Published 2026-09-18

   High·CVSS 8.0 EPSS 0.19%

   FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A cr...

7. CVE-2026-58264 FluidSynth: Heap-based buffer overrun

   Published 2026-09-18

   Critical·CVSS 9.8 EPSS 0.59%

   FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth cha...

8. CVE-2025-56225 fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.

   Published 2026-01-09

   High·CVSS 7.5 EPSS 0.46%

   fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.

9. CVE-2025-68617 Use after free in fluidsynth

   Published 2025-12-23

   High·CVSS 7.0 EPSS 0.21%

   FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading t...

10. CVE-2021-21417 Use after free in fluidsynth

    Published 2021-04-29

    Medium·CVSS 5.5 EPSS 0.94%

    fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.