OESA-2026-3167 (CVE-2026-61714)
Vulnerability from osv_openeuler – Published: 2026-07-24 11:12 – Updated: 2026-08-06 11:12 – Source websiteFluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.
Security Fix(es):
A heap-based buffer overflow was discovered in fluidsynth's MIDI player. When the synth is configured with synth.midi-channels > 16 an out-of-bounds memory access is performed on the array _fluid_player_t::channel_isplaying in heap memory invoking undefined behavior. No crafted MIDI file is required to expose this vulnerability.(CVE-2026-61714)
An unsigned integer overflow in fluidsynth's SF2 parser was discovered. The DMOD chunk handler calculates modulator count as chunk.size / SF_MOD_SIZE - 1. When chunk.size = 0, the division yields 0 and the unsigned subtraction wraps to UINT_MAX (4,294,967,295). The guard check passes because 0 % 10 == 0. The loop iterates billions of times, allocating an SFMod struct per iteration until causing a denial of service via out-of-memory.(CVE-2026-61720)
Fluidsynth's native DLS loader sets sample loop points from file-sourced wsmp.loop_start and wsmp.loop_length values without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). Crafted DLS files with loop values exceeding the sample buffer cause out-of-bounds reads during audio rendering, invoking undefined behavior and denial of service.(CVE-2026-61721)
An integer overflow was discovered in fluidsynth's native DLS parser. The expression cbsize + connblocks * 12 overflows for connblocks = 0x40000001. The loop reads 12 bytes per iteration for ~1 billion iterations (~12.8 GB total) past the chunk boundary.(CVE-2026-61722)
An integer overflow was discovered in fluidsynth's native DLS parser. The ptbl chunk validation uses uint32_t arithmetic: cues * 4 + cbsize != subchunk.size. For cues = 0x40000002 and cbsize = 8, the multiplication overflows: 0x40000002 * 4 = 0x100000008, truncated to 0x8. The check 8 + 8 = 16 == subchunk.size passes. The subsequent poolcues.resize(cues) attempts a ~4GB allocation, and the loop reads billions of entries past the file's chunk boundary.(CVE-2026-61723)
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"fluidsynth-2.5.6-1.oe2403sp4.aarch64.rpm",
"fluidsynth-debuginfo-2.5.6-1.oe2403sp4.aarch64.rpm",
"fluidsynth-debugsource-2.5.6-1.oe2403sp4.aarch64.rpm",
"fluidsynth-devel-2.5.6-1.oe2403sp4.aarch64.rpm"
],
"noarch": [
"fluidsynth-help-2.5.6-1.oe2403sp4.noarch.rpm"
],
"src": [
"fluidsynth-2.5.6-1.oe2403sp4.src.rpm"
],
"x86_64": [
"fluidsynth-2.5.6-1.oe2403sp4.x86_64.rpm",
"fluidsynth-debuginfo-2.5.6-1.oe2403sp4.x86_64.rpm",
"fluidsynth-debugsource-2.5.6-1.oe2403sp4.x86_64.rpm",
"fluidsynth-devel-2.5.6-1.oe2403sp4.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP4",
"name": "fluidsynth",
"purl": "pkg:rpm/openEuler/fluidsynth\u0026distro=openEuler-24.03-LTS-SP4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.6-1.oe2403sp4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow was discovered in fluidsynth\u0026apos;s MIDI player. When the synth is configured with `synth.midi-channels \u0026gt; 16` an out-of-bounds memory access is performed on the array `_fluid_player_t::channel_isplaying` in heap memory invoking undefined behavior. No crafted MIDI file is required to expose this vulnerability.(CVE-2026-61714)\n\nAn unsigned integer overflow in fluidsynth\u0026apos;s SF2 parser was discovered. The DMOD chunk handler calculates modulator count as `chunk.size / SF_MOD_SIZE - 1`. When `chunk.size = 0`, the division yields 0 and the unsigned subtraction wraps to `UINT_MAX` (4,294,967,295). The guard check passes because `0 % 10 == 0`. The loop iterates billions of times, allocating an `SFMod` struct per iteration until causing a denial of service via out-of-memory.(CVE-2026-61720)\n\nFluidsynth\u0026apos;s native DLS loader sets sample loop points from file-sourced `wsmp.loop_start` and `wsmp.loop_length` values without calling `fluid_sample_validate()` or `fluid_sample_sanitize_loop()`. Crafted DLS files with loop values exceeding the sample buffer cause out-of-bounds reads during audio rendering, invoking undefined behavior and denial of service.(CVE-2026-61721)\n\nAn integer overflow was discovered in fluidsynth\u0026apos;s native DLS parser. The expression `cbsize + connblocks * 12` overflows for `connblocks = 0x40000001`. The loop reads 12 bytes per iteration for ~1 billion iterations (~12.8 GB total) past the chunk boundary.(CVE-2026-61722)\n\nAn integer overflow was discovered in fluidsynth\u0026apos;s native DLS parser. The ptbl chunk validation uses `uint32_t` arithmetic: `cues * 4 + cbsize != subchunk.size`. For `cues = 0x40000002` and `cbsize = 8`, the multiplication overflows: `0x40000002 * 4 = 0x100000008`, truncated to `0x8`. The check `8 + 8 = 16 == subchunk.size` passes. The subsequent `poolcues.resize(cues)` attempts a ~4GB allocation, and the loop reads billions of entries past the file\u0026apos;s chunk boundary.(CVE-2026-61723)",
"id": "OESA-2026-3167",
"modified": "2026-08-06T11:12:02Z",
"published": "2026-07-24T11:12:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3167"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61714"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61720"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61721"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61722"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61723"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "fluidsynth security update",
"upstream": [
"CVE-2026-61714",
"CVE-2026-61720",
"CVE-2026-61721",
"CVE-2026-61722",
"CVE-2026-61723"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.