CVE-2026-61722: FluidSynth: DLS Articulation Chunk Integer Overflow
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large connblocks value that wraps the expression and bypasses the chunk-size check, after which the parser performs approximately one billion 12-byte iterations beyond the chunk boundary. The excessive processing and invalid reads can cause denial of service. Builds with the CMake option enable-native-dls set to OFF do not expose the parser. This issue is fixed in version 2.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FluidSynthto a version that resolves this vulnerability.Fixed in 2.5.6 - Configuration
Build FluidSynth with the CMake option enable-native-dls set to OFF so the parser is not exposed.
FluidSynth native DLS parser enable-native-dls = OFF
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FluidSynth versions 2.5.0 through 2.5.6 are affected when built with native DLS parsing enabled. Builds configured with enable-native-dls set to OFF do not expose the vulnerable parser.
What does an attacker need to trigger the flaw?
An attacker needs to provide a crafted DLS file with a large connblocks value. Exploitation does not require privileges or user interaction according to the supplied vector, but it requires the vulnerable parser to process that file.
What is the expected impact of successful exploitation?
The malformed chunk-size calculation can bypass validation, causing roughly one billion 12-byte iterations beyond the chunk boundary. This can result in excessive processing and invalid reads, leading to denial of service.
What can be done if an immediate update is not possible?
Disable the native DLS parser by building FluidSynth with enable-native-dls set to OFF. This removes exposure to the affected parser.