Summary
It was discovered that FluidSynth did not properly validate the channel
argument of the pitch_bend_range command. A remote attacker could
possibly use this issue to cause FluidSynth to crash, resulting in a
denial of service, or execute arbitrary code. (CVE-2026-58264)
It was discovered that FluidSynth incorrectly handled configurations with
more than 16 MIDI channels in its MIDI player, leading to a heap buffer
overflow. An attacker could possibly use this issue to cause FluidSynth
to crash, resulting in a denial of service, or execute arbitrary code.
This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu
26.04 LTS. (CVE-2026-61714)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | fluidsynth | 1.1.6-2ubuntu0.1~esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | fluidsynth | 1.1.6-3ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | fluidsynth | 1.1.9-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | fluidsynth | 2.1.1-2ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | fluidsynth | 2.2.5-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | fluidsynth | 2.3.4-1ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | fluidsynth | 2.4.8+dfsg-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
Critical 9.8
FluidSynth: Heap-based buffer overrun
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through t…
-
High 7.8
FluidSynth: Heap Buffer Overflow in MIDI Player
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while trac…