CVE-2026-61722

A flaw was found in FluidSynth, a software synthesizer. This vulnerability, an integer overflow, exists in the native DLS Downloadable Sounds parser when it validates articulation chunks. A remote attacker could exploit this by providing a specially crafted DLS file, which causes the parser to...

CVE-2026-61723

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a...

CVE-2026-61723 FluidSynth: DLS ptbl Chunk Integer Overflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a...

EUVD-2026-83377

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS...

PT-2026-67250

Name of the Vulnerable Software and Affected Versions FluidSynth versions 2.5.0 through 2.5.5 Description The native DLS parser fails to ensure that the multiplication and addition in the unsigned expression cbsize + connblocks 12 fit within 32 bits when validating articulation chunks. An attacke...

PT-2026-67251

Name of the Vulnerable Software and Affected Versions FluidSynth versions 2.5.0 through 2.5.5 Description The native DLS parser fails to verify if the multiplication and addition of the unsigned expression cues 4 + cbsize fit within 32 bits when validating ptbl chunks. An attacker can use a...