CVE-2026-61723: FluidSynth: DLS ptbl Chunk Integer Overflow
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FluidSynthto a version that resolves this vulnerability.Fixed in 2.5.6 - Configuration
Ensure enable-native-dls is set to OFF so native DLS builds are not exposed.
FluidSynth (native DLS parser) enable-native-dls = OFF
Event History
Frequently Asked Questions
Which deployments are exposed?
FluidSynth versions from 2.5.0 through 2.5.6 are exposed when built with native DLS parsing enabled. Builds configured with enable-native-dls set to OFF are not exposed.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted DLS file containing a ptbl chunk with a large cues value. Exploitation occurs during parsing of that file and does not require privileges or user interaction according to the supplied vector.
What is the impact if exploitation succeeds?
The parser can attempt an allocation of approximately four gigabytes and read billions of entries beyond the DLS chunk boundary. This can cause a denial of service.
What should be done if upgrading is not immediately possible?
Use a build with enable-native-dls set to OFF, which is identified as not exposed. Otherwise, avoid parsing untrusted DLS files until the issue is remediated.