CVE-2025-68617highCWE-416

CVE-2025-68617: high-severity vulnerability in fluidsynth

Use after free in fluidsynth

Published · Updated

Follow this CVE+ Monitor fluidsynth+ Monitor fluidsynth

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7epss 0.2%
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
FluidSynth · fluidsynth
Related CVEs — fluidsynth

In the same product, most dangerous first.

CVE-2021-21417HIGHUse after free in fluidsynthEPSS 0.9%CVE-2026-58264CRITICALFluidSynth: Heap-based buffer overrunEPSS 0.6%CVE-2026-61722MEDIUMFluidSynth: DLS Articulation Chunk Integer OverflowEPSS 0.2%CVE-2026-111123MEDIUMFluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator DestinationEPSS 0.2%CVE-2026-61721HIGHFluidSynth: Heap-based buffer overrun for DLS samplesEPSS 0.2%CVE-2026-61720MEDIUMFluidSynth: SF2 DMOD Chunk Unsigned UnderflowEPSS 0.2%