Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18 vulnerabilities by fluidsynth
CVE-2026-61723 (GCVE-0-2026-61723)
Vulnerability from nvd – Published: 2026-09-18 20:02 – Updated: 2026-09-21 20:47
VLAI
EPSS
VEX
Title
FluidSynth: DLS ptbl Chunk Integer Overflow
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:40 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/a… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61723",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:40:11.237880Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:47:48.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:02:47.793Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-r4mc-v3p8-pv47",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-r4mc-v3p8-pv47"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/a2ab32b9c3b9f8845b7254adea73c211f6c5a24c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/a2ab32b9c3b9f8845b7254adea73c211f6c5a24c"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-r4mc-v3p8-pv47",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: DLS ptbl Chunk Integer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61723",
"datePublished": "2026-09-18T20:02:47.793Z",
"dateReserved": "2026-07-10T18:51:13.921Z",
"dateUpdated": "2026-09-21T20:47:48.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61722 (GCVE-0-2026-61722)
Vulnerability from nvd – Published: 2026-09-18 20:01 – Updated: 2026-09-22 15:44
VLAI
EPSS
VEX
Title
FluidSynth: DLS Articulation Chunk Integer Overflow
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large connblocks value that wraps the expression and bypasses the chunk-size check, after which the parser performs approximately one billion 12-byte iterations beyond the chunk boundary. The excessive processing and invalid reads can cause denial of service. Builds with the CMake option enable-native-dls set to OFF do not expose the parser. This issue is fixed in version 2.5.6.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:43 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/4… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:43:44.365934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:44:05.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large connblocks value that wraps the expression and bypasses the chunk-size check, after which the parser performs approximately one billion 12-byte iterations beyond the chunk boundary. The excessive processing and invalid reads can cause denial of service. Builds with the CMake option enable-native-dls set to OFF do not expose the parser. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:01:58.603Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-hp72-35pr-6h6r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-hp72-35pr-6h6r"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/4d7084fca7c876f5d738498b4917a39faf603425",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/4d7084fca7c876f5d738498b4917a39faf603425"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-hp72-35pr-6h6r",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: DLS Articulation Chunk Integer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61722",
"datePublished": "2026-09-18T20:01:58.603Z",
"dateReserved": "2026-07-10T18:51:13.921Z",
"dateUpdated": "2026-09-22T15:44:05.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61721 (GCVE-0-2026-61721)
Vulnerability from nvd – Published: 2026-09-18 20:00 – Updated: 2026-09-18 20:21
VLAI
EPSS
VEX
Title
FluidSynth: Heap-based buffer overrun for DLS samples
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:21 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/2… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:21:34.730495Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:21:42.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:00:29.403Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-59ph-rx8r-8p4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-59ph-rx8r-8p4j"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/2354c2a9acdb26de7cdcd37c903ee108f46c0a7d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/2354c2a9acdb26de7cdcd37c903ee108f46c0a7d"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-59ph-rx8r-8p4j",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: Heap-based buffer overrun for DLS samples"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61721",
"datePublished": "2026-09-18T20:00:29.403Z",
"dateReserved": "2026-07-10T18:51:13.920Z",
"dateUpdated": "2026-09-18T20:21:42.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61720 (GCVE-0-2026-61720)
Vulnerability from nvd – Published: 2026-09-18 20:03 – Updated: 2026-09-21 16:27
VLAI
EPSS
VEX
Title
FluidSynth: SF2 DMOD Chunk Unsigned Underflow
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:27 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/0… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:27:05.665077Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:27:25.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:03:43.989Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-rmc4-c8hw-455w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-rmc4-c8hw-455w"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/096e1ff0d09ddcac83d94923440706f76f94bc44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/096e1ff0d09ddcac83d94923440706f76f94bc44"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-rmc4-c8hw-455w",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: SF2 DMOD Chunk Unsigned Underflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61720",
"datePublished": "2026-09-18T20:03:43.989Z",
"dateReserved": "2026-07-10T18:51:13.920Z",
"dateUpdated": "2026-09-21T16:27:25.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61714 (GCVE-0-2026-61714)
Vulnerability from nvd – Published: 2026-09-18 20:01 – Updated: 2026-09-25 16:13
VLAI
EPSS
VEX
Title
FluidSynth: Heap Buffer Overflow in MIDI Player
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:12 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/7… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.2.4, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:12:58.096045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:13:08.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.2.4, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:01:14.342Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-976m-35rw-h3m6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-976m-35rw-h3m6"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-976m-35rw-h3m6",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: Heap Buffer Overflow in MIDI Player"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61714",
"datePublished": "2026-09-18T20:01:14.342Z",
"dateReserved": "2026-07-10T18:51:13.920Z",
"dateUpdated": "2026-09-25T16:13:08.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58264 (GCVE-0-2026-58264)
Vulnerability from nvd – Published: 2026-09-18 19:59 – Updated: 2026-09-21 20:47
VLAI
EPSS
VEX
Title
FluidSynth: Heap-based buffer overrun
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:44 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/pull/1796 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/commit/7… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 1.1.2, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:44:11.157258Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:47:56.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.1.2, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:59:39.880Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-mqmq-w63q-cj94",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-mqmq-w63q-cj94"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/pull/1796",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/pull/1796"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/762a3bd39a431cd45abf3bbcce7286c87909d087",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/762a3bd39a431cd45abf3bbcce7286c87909d087"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-mqmq-w63q-cj94",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: Heap-based buffer overrun"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58264",
"datePublished": "2026-09-18T19:59:39.880Z",
"dateReserved": "2026-06-29T21:54:30.331Z",
"dateUpdated": "2026-09-21T20:47:56.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-56225 (GCVE-0-2025-56225)
Vulnerability from nvd – Published: 2026-01-09 00:00 – Updated: 2026-01-12 16:24
VLAI
EPSS
VEX
Summary
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-12 15:36 UTC
CWE
- n/a
- CWE-476 - NULL Pointer Dereference
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-56225",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-12T15:36:18.115430Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-12T16:24:43.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1602"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T16:08:58.854Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/FluidSynth/fluidsynth/issues/1602"
},
{
"url": "https://github.com/FluidSynth/fluidsynth/pull/1607"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-56225",
"datePublished": "2026-01-09T00:00:00.000Z",
"dateReserved": "2025-08-16T00:00:00.000Z",
"dateUpdated": "2026-01-12T16:24:43.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68617 (GCVE-0-2025-68617)
Vulnerability from nvd – Published: 2025-12-23 22:41 – Updated: 2025-12-24 14:53
VLAI
EPSS
VEX
Title
Use after free in fluidsynth
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-24 14:53 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/issues/1717 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/issues/1728 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/commit/6… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/commit/9… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68617",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-24T14:53:30.321128Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-24T14:53:35.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1728"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1717"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T22:41:28.861Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-ffw2-xvvp-39ch",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-ffw2-xvvp-39ch"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/issues/1717",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1717"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/issues/1728",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1728"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/685e54cdc44911ace31774260bd0c9ec89887491",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/685e54cdc44911ace31774260bd0c9ec89887491"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/962b9946b5cb6b16f0c08b89dd1b7016d4fce886",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/962b9946b5cb6b16f0c08b89dd1b7016d4fce886"
}
],
"source": {
"advisory": "GHSA-ffw2-xvvp-39ch",
"discovery": "UNKNOWN"
},
"title": "Use after free in fluidsynth"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-68617",
"datePublished": "2025-12-23T22:41:28.861Z",
"dateReserved": "2025-12-19T14:58:47.825Z",
"dateUpdated": "2025-12-24T14:53:35.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-21417 (GCVE-0-2021-21417)
Vulnerability from nvd – Published: 2021-04-29 17:10 – Updated: 2024-08-03 18:09
VLAI
EPSS
VEX
Title
Use after free in fluidsynth
Summary
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.
Severity
7.2 (High)
CWE
- CWE-416 - {"CWE-416":"Use After Free"}
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/issues/808 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/pull/810 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2021… | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
< 2.1.8
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:09:16.083Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/808"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/FluidSynth/fluidsynth/pull/810"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9"
},
{
"name": "[debian-lts-announce] 20210629 [SECURITY] [DLA 2697-1] fluidsynth security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "{\"CWE-416\":\"Use After Free\"}",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-13T15:13:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/808"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/pull/810"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9"
},
{
"name": "[debian-lts-announce] 20210629 [SECURITY] [DLA 2697-1] fluidsynth security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html"
}
],
"source": {
"advisory": "GHSA-6fcq-pxhc-jxc9",
"discovery": "UNKNOWN"
},
"title": "Use after free in fluidsynth",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21417",
"STATE": "PUBLIC",
"TITLE": "Use after free in fluidsynth"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "fluidsynth",
"version": {
"version_data": [
{
"version_value": "\u003c 2.1.8"
}
]
}
}
]
},
"vendor_name": "FluidSynth"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "{\"CWE-416\":\"Use After Free\"}"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/FluidSynth/fluidsynth/issues/808",
"refsource": "MISC",
"url": "https://github.com/FluidSynth/fluidsynth/issues/808"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/pull/810",
"refsource": "MISC",
"url": "https://github.com/FluidSynth/fluidsynth/pull/810"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9",
"refsource": "CONFIRM",
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9"
},
{
"name": "[debian-lts-announce] 20210629 [SECURITY] [DLA 2697-1] fluidsynth security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html"
}
]
},
"source": {
"advisory": "GHSA-6fcq-pxhc-jxc9",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-21417",
"datePublished": "2021-04-29T17:10:15.000Z",
"dateReserved": "2020-12-22T00:00:00.000Z",
"dateUpdated": "2024-08-03T18:09:16.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-61720 (GCVE-0-2026-61720)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:03 – Updated: 2026-09-21 16:27
VLAI
EPSS
VEX
Title
FluidSynth: SF2 DMOD Chunk Unsigned Underflow
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:27 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/0… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:27:05.665077Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:27:25.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:03:43.989Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-rmc4-c8hw-455w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-rmc4-c8hw-455w"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/096e1ff0d09ddcac83d94923440706f76f94bc44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/096e1ff0d09ddcac83d94923440706f76f94bc44"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-rmc4-c8hw-455w",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: SF2 DMOD Chunk Unsigned Underflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61720",
"datePublished": "2026-09-18T20:03:43.989Z",
"dateReserved": "2026-07-10T18:51:13.920Z",
"dateUpdated": "2026-09-21T16:27:25.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61723 (GCVE-0-2026-61723)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:02 – Updated: 2026-09-21 20:47
VLAI
EPSS
VEX
Title
FluidSynth: DLS ptbl Chunk Integer Overflow
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:40 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/a… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61723",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:40:11.237880Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:47:48.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:02:47.793Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-r4mc-v3p8-pv47",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-r4mc-v3p8-pv47"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/a2ab32b9c3b9f8845b7254adea73c211f6c5a24c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/a2ab32b9c3b9f8845b7254adea73c211f6c5a24c"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-r4mc-v3p8-pv47",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: DLS ptbl Chunk Integer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61723",
"datePublished": "2026-09-18T20:02:47.793Z",
"dateReserved": "2026-07-10T18:51:13.921Z",
"dateUpdated": "2026-09-21T20:47:48.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61722 (GCVE-0-2026-61722)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:01 – Updated: 2026-09-22 15:44
VLAI
EPSS
VEX
Title
FluidSynth: DLS Articulation Chunk Integer Overflow
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large connblocks value that wraps the expression and bypasses the chunk-size check, after which the parser performs approximately one billion 12-byte iterations beyond the chunk boundary. The excessive processing and invalid reads can cause denial of service. Builds with the CMake option enable-native-dls set to OFF do not expose the parser. This issue is fixed in version 2.5.6.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:43 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/4… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:43:44.365934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:44:05.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large connblocks value that wraps the expression and bypasses the chunk-size check, after which the parser performs approximately one billion 12-byte iterations beyond the chunk boundary. The excessive processing and invalid reads can cause denial of service. Builds with the CMake option enable-native-dls set to OFF do not expose the parser. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:01:58.603Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-hp72-35pr-6h6r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-hp72-35pr-6h6r"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/4d7084fca7c876f5d738498b4917a39faf603425",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/4d7084fca7c876f5d738498b4917a39faf603425"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-hp72-35pr-6h6r",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: DLS Articulation Chunk Integer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61722",
"datePublished": "2026-09-18T20:01:58.603Z",
"dateReserved": "2026-07-10T18:51:13.921Z",
"dateUpdated": "2026-09-22T15:44:05.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61714 (GCVE-0-2026-61714)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:01 – Updated: 2026-09-25 16:13
VLAI
EPSS
VEX
Title
FluidSynth: Heap Buffer Overflow in MIDI Player
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:12 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/7… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.2.4, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:12:58.096045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:13:08.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.2.4, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:01:14.342Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-976m-35rw-h3m6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-976m-35rw-h3m6"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-976m-35rw-h3m6",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: Heap Buffer Overflow in MIDI Player"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61714",
"datePublished": "2026-09-18T20:01:14.342Z",
"dateReserved": "2026-07-10T18:51:13.920Z",
"dateUpdated": "2026-09-25T16:13:08.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61721 (GCVE-0-2026-61721)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:00 – Updated: 2026-09-18 20:21
VLAI
EPSS
VEX
Title
FluidSynth: Heap-based buffer overrun for DLS samples
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:21 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/commit/2… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:21:34.730495Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:21:42.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:00:29.403Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-59ph-rx8r-8p4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-59ph-rx8r-8p4j"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/2354c2a9acdb26de7cdcd37c903ee108f46c0a7d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/2354c2a9acdb26de7cdcd37c903ee108f46c0a7d"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-59ph-rx8r-8p4j",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: Heap-based buffer overrun for DLS samples"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61721",
"datePublished": "2026-09-18T20:00:29.403Z",
"dateReserved": "2026-07-10T18:51:13.920Z",
"dateUpdated": "2026-09-18T20:21:42.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58264 (GCVE-0-2026-58264)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:59 – Updated: 2026-09-21 20:47
VLAI
EPSS
VEX
Title
FluidSynth: Heap-based buffer overrun
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:44 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/pull/1796 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/commit/7… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 1.1.2, < 2.5.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:44:11.157258Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:47:56.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.1.2, \u003c 2.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:59:39.880Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-mqmq-w63q-cj94",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-mqmq-w63q-cj94"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/pull/1796",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/pull/1796"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/762a3bd39a431cd45abf3bbcce7286c87909d087",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/762a3bd39a431cd45abf3bbcce7286c87909d087"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6"
}
],
"source": {
"advisory": "GHSA-mqmq-w63q-cj94",
"discovery": "UNKNOWN"
},
"title": "FluidSynth: Heap-based buffer overrun"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58264",
"datePublished": "2026-09-18T19:59:39.880Z",
"dateReserved": "2026-06-29T21:54:30.331Z",
"dateUpdated": "2026-09-21T20:47:56.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-56225 (GCVE-0-2025-56225)
Vulnerability from cvelistv5 – Published: 2026-01-09 00:00 – Updated: 2026-01-12 16:24
VLAI
EPSS
VEX
Summary
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-12 15:36 UTC
CWE
- n/a
- CWE-476 - NULL Pointer Dereference
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-56225",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-12T15:36:18.115430Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-12T16:24:43.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1602"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T16:08:58.854Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/FluidSynth/fluidsynth/issues/1602"
},
{
"url": "https://github.com/FluidSynth/fluidsynth/pull/1607"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-56225",
"datePublished": "2026-01-09T00:00:00.000Z",
"dateReserved": "2025-08-16T00:00:00.000Z",
"dateUpdated": "2026-01-12T16:24:43.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68617 (GCVE-0-2025-68617)
Vulnerability from cvelistv5 – Published: 2025-12-23 22:41 – Updated: 2025-12-24 14:53
VLAI
EPSS
VEX
Title
Use after free in fluidsynth
Summary
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-24 14:53 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://github.com/FluidSynth/fluidsynth/issues/1717 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/issues/1728 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/commit/6… | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/commit/9… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
>= 2.5.0, < 2.5.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68617",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-24T14:53:30.321128Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-24T14:53:35.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1728"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1717"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T22:41:28.861Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-ffw2-xvvp-39ch",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-ffw2-xvvp-39ch"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/issues/1717",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1717"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/issues/1728",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/1728"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/685e54cdc44911ace31774260bd0c9ec89887491",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/685e54cdc44911ace31774260bd0c9ec89887491"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/commit/962b9946b5cb6b16f0c08b89dd1b7016d4fce886",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/commit/962b9946b5cb6b16f0c08b89dd1b7016d4fce886"
}
],
"source": {
"advisory": "GHSA-ffw2-xvvp-39ch",
"discovery": "UNKNOWN"
},
"title": "Use after free in fluidsynth"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-68617",
"datePublished": "2025-12-23T22:41:28.861Z",
"dateReserved": "2025-12-19T14:58:47.825Z",
"dateUpdated": "2025-12-24T14:53:35.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-21417 (GCVE-0-2021-21417)
Vulnerability from cvelistv5 – Published: 2021-04-29 17:10 – Updated: 2024-08-03 18:09
VLAI
EPSS
VEX
Title
Use after free in fluidsynth
Summary
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.
Severity
7.2 (High)
CWE
- CWE-416 - {"CWE-416":"Use After Free"}
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/FluidSynth/fluidsynth/issues/808 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/pull/810 | x_refsource_MISC |
| https://github.com/FluidSynth/fluidsynth/security… | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2021… | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
< 2.1.8
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:09:16.083Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/808"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/FluidSynth/fluidsynth/pull/810"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9"
},
{
"name": "[debian-lts-announce] 20210629 [SECURITY] [DLA 2697-1] fluidsynth security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "{\"CWE-416\":\"Use After Free\"}",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-13T15:13:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/issues/808"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FluidSynth/fluidsynth/pull/810"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9"
},
{
"name": "[debian-lts-announce] 20210629 [SECURITY] [DLA 2697-1] fluidsynth security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html"
}
],
"source": {
"advisory": "GHSA-6fcq-pxhc-jxc9",
"discovery": "UNKNOWN"
},
"title": "Use after free in fluidsynth",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21417",
"STATE": "PUBLIC",
"TITLE": "Use after free in fluidsynth"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "fluidsynth",
"version": {
"version_data": [
{
"version_value": "\u003c 2.1.8"
}
]
}
}
]
},
"vendor_name": "FluidSynth"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "{\"CWE-416\":\"Use After Free\"}"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/FluidSynth/fluidsynth/issues/808",
"refsource": "MISC",
"url": "https://github.com/FluidSynth/fluidsynth/issues/808"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/pull/810",
"refsource": "MISC",
"url": "https://github.com/FluidSynth/fluidsynth/pull/810"
},
{
"name": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9",
"refsource": "CONFIRM",
"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9"
},
{
"name": "[debian-lts-announce] 20210629 [SECURITY] [DLA 2697-1] fluidsynth security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html"
}
]
},
"source": {
"advisory": "GHSA-6fcq-pxhc-jxc9",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-21417",
"datePublished": "2021-04-29T17:10:15.000Z",
"dateReserved": "2020-12-22T00:00:00.000Z",
"dateUpdated": "2024-08-03T18:09:16.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}