Out-of-Bounds Write Vulnerability in FluidSynth Software Synthesizer

CVE-2026-58264

What is CVE-2026-58264?

An out-of-bounds write vulnerability exists in FluidSynth's command handler, where the pitch_bend_range command's channel argument lacks adequate bounds checking. This could lead to an out-of-bounds heap write, allowing an attacker to execute malicious commands either remotely, when the TCP server is enabled, or locally through the FluidSynth shell. Applications that do not utilize the shell, command handler, or TCP server remain unaffected. The vulnerability has been addressed in version 2.5.6.

References