CVE-2026-58264: FluidSynth: Heap-based buffer overrun
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through newfluidserver() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FluidSynthto a version that resolves this vulnerability.Fixed in 2.5.6 - Compensating control
If you enable the TCP server (new_fluid_server() or fluidsynth -s), consider disabling it or limiting access until you upgrade to FluidSynth 2.5.6.
- Compensating control
If you use the FluidSynth shell on standard input, ensure only trusted commands are delivered (since the issue is locally reachable via malicious commands on standard input) until you upgrade to FluidSynth 2.5.6.
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments with the FluidSynth TCP server enabled are remotely reachable, including those created with new_fluid_server() or started with fluidsynth -s. Applications that do not use the shell, command handler, or TCP server are not affected.
What does an attacker need to exploit the issue?
An attacker needs to submit a pitch_bend_range command with an out-of-range channel value to the FluidSynth command handler. This can be done remotely through an enabled TCP server or locally through malicious commands supplied to the FluidSynth shell on standard input.
Which versions require remediation?
FluidSynth versions from 1.1.2 until 2.5.6 are affected. The issue is fixed in version 2.5.6.
What is the mitigation if an update cannot be applied immediately?
Disable or avoid use of the FluidSynth TCP server, shell, and command handler where possible. Applications that do not use these interfaces are not affected.