Out-of-Bounds Write in FluidSynth Product from FluidSynth
CVE-2026-111123
6.9MEDIUM
What is CVE-2026-111123?
FluidSynth versions up to 2.6.1 are susceptible to an out-of-bounds write vulnerability due to unvalidated modulator destination values within SoundFont files. Attackers can exploit this weakness by crafting malicious SF2 files targeting PMOD/IMOD destinations ranging from 63 to 255. When these files are processed, the vulnerability can lead to corruption of heap and stack memory, resulting in application crashes and potential exploitation. Proper validation of input values is crucial to mitigate this risk.
Affected Version(s)
fluidsynth 0 <= 2.6.1
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology