Buffer Overflow Vulnerability in FluidSynth Software Synthesizer

CVE-2026-61714

What is CVE-2026-61714?

FluidSynth versions 2.2.4 to 2.5.6 exhibit a buffer overflow vulnerability when configuring synth.midi-channels beyond 16. This misconfiguration leads to out-of-bounds reads and writes due to insufficient memory allocation for active MIDI channels. The exploitation of this vulnerability can compromise the security aspects of confidentiality, integrity, and availability of the software. To mitigate this vulnerability, users are advised to maintain the default channel setting or upgrade to version 2.5.6, which includes a fix.

References