CVE-2026-61720: FluidSynth: SF2 DMOD Chunk Unsigned Underflow
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SFMODSIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINTMAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FluidSynthto a version that resolves this vulnerability.Fixed in 2.5.6
Event History
Frequently Asked Questions
Which deployments are affected?
FluidSynth versions from 2.5.0 through 2.5.5 are affected. Version 2.5.6 contains the fix.
What does an attacker need to trigger the denial of service?
An attacker needs to cause FluidSynth to parse a crafted SF2 file with a zero-sized DMOD chunk. The malformed chunk causes an unsigned count to wrap and leads to attempted allocation of billions of SFMod objects.
What is the impact of successful exploitation?
Successful exploitation exhausts the FluidSynth process memory and causes a denial of service. The provided impact information does not indicate confidentiality or integrity effects.
What mitigation is available if upgrading is not immediately possible?
No workaround is available in the provided advisory information. Upgrade to FluidSynth 2.5.6 to remediate the issue.