CVE-2026-111123Medium· 6.1▾ TwilightPoC availableFluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 33.6 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61714High· 7.8FluidSynth is a software synthesizer based on the SoundFont 2 specifications
CVE-2026-61723Medium· 6.8FluidSynth is a software synthesizer based on the SoundFont 2 specifications
CVE-2026-61720Medium· 6.2FluidSynth is a software synthesizer based on the SoundFont 2 specifications
CVE-2026-61721High· 8.0FluidSynth is a software synthesizer based on the SoundFont 2 specifications
CVE-2026-61722Medium· 6.8FluidSynth is a software synthesizer based on the SoundFont 2 specifications
CVE-2026-58264Critical· 9.8FluidSynth is a software synthesizer based on the SoundFont 2 specifications