Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M
CVE-2026-61721FluidSynth: Heap-based buffer overrun for DLS samples
High 8.0
In plain English
A high-severity heap buffer overflow in fluidsynth from FluidSynth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | fluidsynth | 2.5.6+dfsg-1 | DEBIAN-CVE-2026-61721 |
| Ubuntu:22.04:LTS | fluidsynth | no fix listed | UBUNTU-CVE-2026-61721 |
| Ubuntu:24.04:LTS | fluidsynth | no fix listed | UBUNTU-CVE-2026-61721 |
| Ubuntu:26.04:LTS | fluidsynth | no fix listed | UBUNTU-CVE-2026-61721 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FluidSynth | fluidsynth | >= 2.5.0, < 2.5.6 |
Weakness: CWE-122, CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H