Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M
CVE-2026-61714FluidSynth: Heap Buffer Overflow in MIDI Player
High 7.8
In plain English
A high-severity heap buffer overflow in fluidsynth from FluidSynth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | fluidsynth | no fix listed | DEBIAN-CVE-2026-61714 |
| Debian:13 | fluidsynth | 2.4.4+dfsg-1+deb13u3 | DEBIAN-CVE-2026-61714 |
| Debian:14 | fluidsynth | 2.5.6+dfsg-1 | DEBIAN-CVE-2026-61714 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FluidSynth | fluidsynth | >= 2.2.4, < 2.5.6 |
Weakness: CWE-122, CWE-125, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H