OESA-2026-3167

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.

Security Fix(es):

A heap-based buffer overflow was discovered in fluidsynth's MIDI player. When the synth is configured with synth.midi-channels > 16 an out-of-bounds memory access is performed on the array _fluid_player_t::channel_isplaying in heap memory invoking undefined behavior. No crafted MIDI file is required to expose this vulnerability.(CVE-2026-61714)

An unsigned integer overflow in fluidsynth's SF2 parser was discovered. The DMOD chunk handler calculates modulator count as chunk.size / SF_MOD_SIZE - 1. When chunk.size = 0, the division yields 0 and the unsigned subtraction wraps to UINT_MAX (4,294,967,295). The guard check passes because 0 % 10 == 0. The loop iterates billions of times, allocating an SFMod struct per iteration until causing a denial of service via out-of-memory.(CVE-2026-61720)

Fluidsynth's native DLS loader sets sample loop points from file-sourced wsmp.loop_start and wsmp.loop_length values without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). Crafted DLS files with loop values exceeding the sample buffer cause out-of-bounds reads during audio rendering, invoking undefined behavior and denial of service.(CVE-2026-61721)

An integer overflow was discovered in fluidsynth's native DLS parser. The expression cbsize + connblocks * 12 overflows for connblocks = 0x40000001. The loop reads 12 bytes per iteration for ~1 billion iterations (~12.8 GB total) past the chunk boundary.(CVE-2026-61722)

An integer overflow was discovered in fluidsynth's native DLS parser. The ptbl chunk validation uses uint32_t arithmetic: cues * 4 + cbsize != subchunk.size. For cues = 0x40000002 and cbsize = 8, the multiplication overflows: 0x40000002 * 4 = 0x100000008, truncated to 0x8. The check 8 + 8 = 16 == subchunk.size passes. The subsequent poolcues.resize(cues) attempts a ~4GB allocation, and the loop reads billions of entries past the file's chunk boundary.(CVE-2026-61723)