Denial of Service Vulnerability in FluidSynth Software Synthesizer

CVE-2026-61723

What is CVE-2026-61723?

FluidSynth, a software synthesizer compliant with the SoundFont 2 specifications, is susceptible to a denial of service attack due to a flaw in its native DLS parser. Versions 2.5.0 to 2.5.6 fail to validate the ptbl chunks correctly, allowing an attacker to provide a specially crafted DLS file that manipulates the cues value. This oversight can result in significant memory allocation requests, causing the parser to read beyond intended boundaries, potentially leading to system crashes or unresponsive states. Users should upgrade to version 2.5.6, which addresses this vulnerability by enforcing proper validation checks.

References