CVE-2026-61721: falha de alta gravidade em fluidsynth
FluidSynth: Heap-based buffer overrun for DLS samples
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8epss 0.2%
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Produtos afetados
FluidSynth · fluidsynthCVEs relacionadas — fluidsynth
No mesmo produto, das mais perigosas para as menos.
CVE-2021-21417HIGHUse after free in fluidsynthEPSS 0.9%CVE-2026-58264CRITICALFluidSynth: Heap-based buffer overrunEPSS 0.6%CVE-2025-68617HIGHUse after free in fluidsynthEPSS 0.2%CVE-2026-61722MEDIUMFluidSynth: DLS Articulation Chunk Integer OverflowEPSS 0.2%CVE-2026-111123MEDIUMFluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator DestinationEPSS 0.2%CVE-2026-61720MEDIUMFluidSynth: SF2 DMOD Chunk Unsigned UnderflowEPSS 0.2%