CVE-2026-61721: Fluidsynth

High severity, CVSS 8.0. EPSS: 0.2% chance of exploitation in the next 30 days.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.

Affected products

• Fluidsynth Fluidsynth: from 2.5.0, before 2.5.6 (fixed in 2.5.6)

Published 2026-09-18. Last modified 2026-09-23.