Vulnerability Description
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/FluidSynth/fluidsynth/commit/2354c2a9acdb26de7cdcd37c903ee108
- https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6
- https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-59ph-rx8r-8p4j
FAQ
What is CVE-2026-61721?
CVE-2026-61721 is a vulnerability with a CVSS score of 8.0 (HIGH). FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to sampl...
How severe is CVE-2026-61721?
CVE-2026-61721 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61721?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.