CVE-2026-61721: FluidSynth: Heap-based buffer overrun for DLS samples
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loopstart and wsmp.looplength values to samples without calling fluidsamplevalidate() or fluidsamplesanitizeloop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FluidSynthto a version that resolves this vulnerability.Fixed in 2.5.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FluidSynth versions from 2.5.0 through 2.5.6 are affected when built with native DLS loading enabled. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser.
What does an attacker need to exploit it?
An attacker needs to provide a crafted DLS file that is processed by the native DLS loader. The file controls loop_start and loop_length values that can place loop points beyond the sample buffer during audio rendering.
What can be done if updating is not immediately possible?
Disable the native DLS loader by building FluidSynth with enable-native-dls set to OFF. Avoid processing untrusted DLS files until the issue is remediated.
How can I determine whether a build is affected?
Check whether the deployed FluidSynth version falls between 2.5.0 and 2.5.6 and whether it was compiled with native DLS loading enabled. A build with enable-native-dls set to OFF is not affected by this parser issue.