Out-of-bounds write in FluidSynth SoundFont modulator handling
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
FluidSynth through 2.6.1 contains an out-of-bounds write (CWE-787) because it does not validate SoundFont modulator destination values. A local attacker can craft an SF2 file with PMOD or IMOD destinations from 63 to 255 that, when a user loads and plays it, writes past the voice generator array and corrupts heap and stack memory, causing crashes.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FluidSynth | fluidsynth | up to 2.6.1 | — | No fix listed | CNA |
- fluidsynth VendorFluidSynth Affected up to 2.6.1 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for FluidSynth.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Vendor assessments
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111123
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
References
Other 5
- https://hackmd.io/@haind-pwn/fluidsynth-sf2-modulator-dest-generator-oob-write
- https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/synth/fluid_voice.c#L615-L623
- https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/synth/fluid_voice.c#L1184-L1229
- https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/sfloader/fluid_defsfont.c#L1609-L1611
- https://github.com/FluidSynth/fluidsynth
More FluidSynth vulnerabilities
- TI-2025-35279 fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in… CVSS 3.1HIGH 7.5
- TI-2025-42135 Use after free in fluidsynth CVSS 3.1HIGH 7.0
- TI-2026-41957 FluidSynth: Heap-based buffer overrun CVSS 3.1CRITICAL 9.8
- TI-2026-44176 FluidSynth: Heap Buffer Overflow in MIDI Player CVSS 3.1HIGH 7.8
- TI-2026-44179 FluidSynth: Heap-based buffer overrun for DLS samples CVSS 3.1HIGH 8.0
- TI-2021-04515 Use after free in fluidsynth CVSS 3.1HIGH 7.2
Sources
- CVE-2026-111123 · CVE Program
- CVE-2026-111123 · NVD
- FIRST EPSS
- CVE-2026-111123 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences