CVE-2026-61714

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61714
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61714.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61714
Aliases
  • GHSA-976m-35rw-h3m6
Downstream
DEBIAN (1)
ECHO (1)
OESA (4)
UBUNTU (1)
Published
2026-09-18T20:01:14Z
Modified
2026-09-27T08:04:13Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
FluidSynth: Heap Buffer Overflow in MIDI Player
Details

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-125",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61714.json"
}
References

Affected packages

Git / github.com/fluidsynth/fluidsynth

Affected ranges

Type
GIT
Repo
https://github.com/fluidsynth/fluidsynth
Events
Introduced
6c807bdd37748411801e93c48fcd5789d5a6a278
Fixed
772702e00cc6acc7c607efb40283e2269211effc
Fixed
e5b11058a619246cea42976dacb76ca54be3d45d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.2.4"
        },
        {
            "fixed": "2.5.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61714.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "87359487580782351160080197411551283143",
            "length": 975
        },
        "id": "CVE-2026-61714-2efc911f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/fluidsynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc",
        "target": {
            "file": "src/midi/fluid_midi.c",
            "function": "fluid_track_send_events"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "267440107168714997952004663393268998891",
                "196723629061604134957373830173976236641",
                "100539508606770241320005723875037127478",
                "146362237449310531819106135935394524307",
                "258864544547400855228098642069488190527",
                "263900233866757251929601477411064814493",
                "128437275226719610226689530981456521429",
                "211354715482837168973689664037791155127",
                "175519166067010002318438965348489917266",
                "59465159399387871108611879884524155737",
                "327619018834497166555209086163401370980",
                "20949894669433155002788575553734932233",
                "76869915893478848577345034348225305258",
                "33193263307394835778987596493297839573",
                "327619018834497166555209086163401370980",
                "20949894669433155002788575553734932233"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-61714-579a2ff7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/fluidsynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc",
        "target": {
            "file": "src/midi/fluid_midi.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "90784707155493712384221136257798104560",
            "length": 3284
        },
        "id": "CVE-2026-61714-ab68c2c7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/fluidsynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc",
        "target": {
            "file": "src/midi/fluid_midi.c",
            "function": "fluid_player_callback"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "65741976735742723877597808461499147360",
                "158873129713208397340236107564649355567",
                "27858880504209789441457038429492907366",
                "242142550883552540884961556422285883183"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-61714-ae4f73c0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/fluidsynth/fluidsynth/commit/e5b11058a619246cea42976dacb76ca54be3d45d",
        "target": {
            "file": "src/sfloader/fluid_dls.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "109398306651516327573478367773148522902",
            "length": 9029
        },
        "id": "CVE-2026-61714-b1a5b579",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/fluidsynth/fluidsynth/commit/e5b11058a619246cea42976dacb76ca54be3d45d",
        "target": {
            "file": "src/sfloader/fluid_dls.cpp",
            "function": "fluid_dls_font::fluid_dls_font"
        }
    }
]
vanir_signatures_modified 
"2026-09-27T08:04:13Z"