CVE-2025-68617: fallo de gravedad alta en fluidsynth
Use after free in fluidsynth
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7epss 0.2%
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
FluidSynth · fluidsynthCVEs relacionadas — fluidsynth
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-21417HIGHUse after free in fluidsynthEPSS 0.9%CVE-2026-58264CRITICALFluidSynth: Heap-based buffer overrunEPSS 0.6%CVE-2026-61722MEDIUMFluidSynth: DLS Articulation Chunk Integer OverflowEPSS 0.2%CVE-2026-111123MEDIUMFluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator DestinationEPSS 0.2%CVE-2026-61721HIGHFluidSynth: Heap-based buffer overrun for DLS samplesEPSS 0.2%CVE-2026-61720MEDIUMFluidSynth: SF2 DMOD Chunk Unsigned UnderflowEPSS 0.2%
Referencias
https://github.com/FluidSynth/fluidsynth/commit/685e54cdc44911ace31774260bd0c9ec89887491https://github.com/FluidSynth/fluidsynth/commit/962b9946b5cb6b16f0c08b89dd1b7016d4fce886https://github.com/FluidSynth/fluidsynth/issues/1717https://github.com/FluidSynth/fluidsynth/issues/1728https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-ffw2-xvvp-39ch