CVE-2026-58264 FluidSynth: Heap-based buffer overrun

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

CVE-2026-58264 FluidSynth: Heap-based buffer overrun

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

CVE-2026-58264

FluidSynth , a software synthesizer based on the SoundFont 2 specifications, is affected by an out-of-bounds heap write in its command handler. The pitch_bend_range command accepts a channel argument that is not bounds-checked before writing the supplied value through the selected synth channel. ...

EUVD-2026-83374

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

CVE-2026-58264 FluidSynth: Heap-based buffer overrun

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

CVE-2026-61714: Heap-based Buffer Overflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index fluidplayert::channelisplaying outside its fixed-size heap allocation while tracking active channels. The resulting...

CVE-2026-58264: Heap-based Buffer Overflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

CVE-2026-61723: Integer Overflow or Wraparound

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a...

CVE-2026-61721: Heap-based Buffer Overflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loopstart and wsmp.looplength values to samples without calling fluidsamplevalidate or fluidsamplesanitizeloop. A crafted DLS file can place...

CVE-2026-61720: Integer Underflow (Wrap or Wraparound)

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SFMODSIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the...

CVE-2026-61722: Integer Overflow or Wraparound

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS...

Astra Linux – Vulnerability in fluidsynth

Fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, which can be triggered when loading an invalid SoundFont file...

Linux Distros Unpatched Vulnerability : CVE-2026-58264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange...

Linux Distros Unpatched Vulnerability : CVE-2026-61714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI...

OESA-2026-3168 fluidsynth security update

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use...

OESA-2026-3166 fluidsynth security update

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use...

OESA-2026-3165 fluidsynth security update

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use...

OESA-2026-3167 fluidsynth security update

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use...

PT-2026-67247

Name of the Vulnerable Software and Affected Versions FluidSynth affected versions not specified Description A heap-based buffer overflow exists in the MIDI player. When the synthesizer is configured with the synth.midi-channels variable set to a value greater than 16, an out-of-bounds memory...

PT-2026-67248

Name of the Vulnerable Software and Affected Versions FluidSynth versions 2.5.0 through 2.5.5 Description The SF2 parser in this software synthesizer fails to reject chunks smaller than one record when computing the DMOD modulator count. A specially crafted SF2 file with a zero-sized DMOD chunk...