CVE-2026-61714: FluidSynth: Heap Buffer Overflow in MIDI Player
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index fluidplayert::channelisplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FluidSynthto a version that resolves this vulnerability.Fixed in 2.5.6 - Configuration
Keep synth.midi-channels at the default value of 16 to avoid the vulnerable path where values above 16 trigger the heap buffer overflow in the MIDI player.
FluidSynth synth.midi-channels = 16
Event History
Frequently Asked Questions
Are deployments using the default configuration affected?
The vulnerable path is avoided when synth.midi-channels remains at its default value of 16. Configurations with synth.midi-channels above 16 are affected in the vulnerable versions.
Does exploitation require a specially crafted MIDI file?
No. The unsafe condition is created by configuring synth.midi-channels above 16; no crafted MIDI file is required.
What can be done if upgrading is not immediately possible?
Set or keep synth.midi-channels at 16 to avoid the vulnerable path. Upgrade to FluidSynth 2.5.6 when possible.
How can I identify potentially affected instances?
Check the installed FluidSynth version and the synth.midi-channels setting. Instances in the affected version range with the setting above 16 should be treated as exposed.