CVE-2026-111123

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-111123

FluidSynth versions through 2.6.1 are vulnerable to an out-of-bounds write (CWE-787) caused by unvalidated SoundFont modulator destination values. By crafting an SF2 file with PMOD/IMOD destinations ranging from 63 to 255 , an attacker can trigger a write past the voice generator array and update...