{"id":"CVE-2026-61721","title":"FluidSynth is a software synthesizer based on the SoundFont 2 specifications","summary":"FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_valid…","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cwe":["CWE-122","CWE-125"],"vendor":"FluidSynth","product":"fluidsynth","affected":["fluidsynth >= 2.5.0, < 2.5.6"],"published":"2026-09-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T21:17:02.147","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61721","references":[{"url":"https://github.com/FluidSynth/fluidsynth/commit/2354c2a9acdb26de7cdcd37c903ee108f46c0a7d","label":"security-advisories@github.com"},{"url":"https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6","label":"security-advisories@github.com"},{"url":"https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-59ph-rx8r-8p4j","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-18T20:21:34.730495Z"},"ingestedAt":"2026-09-18T20:51:25.675Z","epss":0.00149,"epssPercentile":0.04466,"slug":"CVE-2026-61721","body":"## Overview\n\nFluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}