Race Condition Vulnerability in FluidSynth Software Synthesizer

CVE-2025-68617

What is CVE-2025-68617?

FluidSynth, a software synthesizer compliant with SoundFont 2 specifications, is susceptible to a race condition affecting the unloading of DLS files. In versions ranging from 2.5.0 to before 2.5.2, this vulnerability can result in a heap-based use-after-free error. When a DLS file is being unloaded while another thread is concurrently attempting to use it for audio synthesis, it may read from a region of memory that has already been freed, potentially leading to erratic behaviors or crashes. This issue has been addressed in version 2.5.2, and users are advised to upgrade. The issue is avoided when a DLS file is unloaded explicitly prior to the destruction of the synthesizer, as long as no samples from that file are in use.

References