CVE-2026-61714

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61714
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61714.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61714
Aliases
  • GHSA-976m-35rw-h3m6
Downstream
Published
2026-09-18T20:01:14Z
Modified
2026-09-20T11:46:52Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
FluidSynth: Heap Buffer Overflow in MIDI Player
Details

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-125",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61714.json"
}
References

Affected packages

Git / github.com/fluidsynth/fluidsynth

Affected ranges

Type
GIT
Repo
https://github.com/fluidsynth/fluidsynth
Events
Introduced
6c807bdd37748411801e93c48fcd5789d5a6a278
Fixed
772702e00cc6acc7c607efb40283e2269211effc
Fixed
e5b11058a619246cea42976dacb76ca54be3d45d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.2.4"
        },
        {
            "fixed": "2.5.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61714.json"