---
id: CVE-2026-111123
title: >-
  FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that
  allows attackers to corrupt heap and stack memory by supplying unvalidated
  SoundFont modulator destination values
summary: >-
  FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that
  allows attackers to corrupt heap and stack memory by supplying unvalidated
  SoundFont modulator destination values. Attackers can craft an SF2 file with
  PMOD/IMOD…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cwe:
  - CWE-787
vendor: FluidSynth
product: fluidsynth
affected:
  - fluidsynth <= 2.6.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:25.580'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111123'
references:
  - url: 'https://github.com/FluidSynth/fluidsynth'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/sfloader/fluid_defsfont.c#L1609-L1611
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/synth/fluid_voice.c#L1184-L1229
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/synth/fluid_voice.c#L615-L623
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@haind-pwn/fluidsynth-sf2-modulator-dest-generator-oob-write
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/fluidsynth-through-2.6.1-out-of-bounds-write-via-soundfont-modulator-destination
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
ingestedAt: '2026-10-15T19:25:46.406Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T19:46:04.553463Z'
---

## Overview

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.