CVE-2026-111123

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111123
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111123.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111123
Downstream
Published
2026-10-15T18:57:20Z
Modified
2026-10-16T10:46:27Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination
Details

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111123.json"
}
References

Affected packages

Git / github.com/fluidsynth/fluidsynth

Affected ranges

Type
GIT
Repo
https://github.com/fluidsynth/fluidsynth
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
71e85b2ca6bf48641ba7e2261d8f2640ae473773
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "2.6.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v2.*
v2.0.0
v2.0.0.beta1
v2.0.0.beta2
v2.0.0.rc1
v2.0.1
v2.0.2
v2.1.0
v2.1.0.rc1
v2.1.1
v2.1.2
v2.1.3
v2.2.0
v2.2.0.beta1
v2.2.0.rc1
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111123.json"