Fluidsynth vulnerabilities
Published CVEs affecting Fluidsynth products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-111123
Medium · 6.1
CWE-787 Oct 15, 2026
FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.
CVE-2025-56225
High · 7.5
CWE-476 Jan 9, 2026
NULL Pointer Dereference in Fluidsynth
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
CVE-2025-68617
High · 7.0
CWE-416 Dec 23, 2025
Use after free in fluidsynth
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support.