CVE-2026-111123: FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updatedgenbit, causing memory corruption and crashes.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the vulnerability?
An attacker must supply a crafted SF2 SoundFont file containing PMOD or IMOD modulator destination values from 63 through 255. The vulnerable behavior occurs when that SoundFont is loaded and played.
Are systems exposed merely by having FluidSynth installed?
The described trigger requires loading and playing an attacker-controlled SoundFont. The provided information does not indicate that installation alone is sufficient to trigger the issue.
What is the observable impact of successful exploitation?
The malformed modulator destination values cause writes past the voice generator array and updated_gen_bit. This corrupts heap and stack memory and can cause crashes.