p PatchFirst

CVE-2026-61720

CVE-2026-61720 · FluidSynth: SF2 DMOD Chunk Unsigned Underflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.

CVSS 6.2 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • fluidsynth

    Versions
    • >= 2.5.0, < 2.5.6: Affected

    No fix published

  • fluidsynth Debian:14

    Versions
    • 2.4.4+dfsg-1
    • 2.4.6+dfsg-1
    • 2.4.7+dfsg-1
    • 2.4.7+dfsg-2
    • 2.4.8+dfsg-1
    • 2.5.0+dfsg-1
    • 2.5.1+dfsg-1
    • 2.5.1+dfsg-2
    • 2.5.2+dfsg-1
    • 2.5.3+dfsg-1
    • 2.5.4+dfsg-1
    • 2.5.5+dfsg-1
    • 2.5.5+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 2.5.6+dfsg-1

    Update to 2.5.6+dfsg-1

  • fluidsynth Ubuntu:Pro:14.04:LTS

    Versions
    • 1.1.6-2
    • 1.1.6-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fluidsynth Ubuntu:Pro:16.04:LTS

    Versions
    • 1.1.6-2build1
    • 1.1.6-3
    • 1.1.6-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fluidsynth Ubuntu:Pro:18.04:LTS

    Versions
    • 1.1.6-4
    • 1.1.8-1
    • 1.1.8-2
    • 1.1.8-3
    • 1.1.9-1
    • 1.1.9-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fluidsynth Ubuntu:Pro:20.04:LTS

    Versions
    • 1.1.11-4
    • 1.1.11-4ubuntu1
    • 2.1.0-1
    • 2.1.1-2
    • 2.1.1-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fluidsynth Ubuntu:Pro:22.04:LTS

    Versions
    • 2.1.7-1.1
    • 2.2.4-2
    • 2.2.5-1
    • 2.2.5-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fluidsynth Ubuntu:Pro:24.04:LTS

    Versions
    • 2.3.3-2.1
    • 2.3.4-1
    • 2.3.4-1build1
    • 2.3.4-1build2
    • 2.3.4-1build3
    • 2.3.4-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fluidsynth Ubuntu:Pro:26.04:LTS

    Versions
    • 2.4.7+dfsg-2
    • 2.4.8+dfsg-1
    • 2.4.8+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →