CVE-2026-58264

critical

Published 2026-09-18 · Modified 2026-09-18

Discuss on Community Propose mitigation

CVSS v3

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

9.8

Description

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.

Predictions

Exploit likelihood

97%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-58264 NameCVE-2026-58264 Descriptionheap-based buffer overrun in command handler SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus fluidsynth…

CVE-2026-58264

Name	CVE-2026-58264
Description	heap-based buffer overrun in command handler
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fluidsynth (PTS)	bullseye	2.1.7-1.1	vulnerable
	bookworm	2.3.1-2	vulnerable
	trixie	2.4.4+dfsg-1+deb13u2	vulnerable
	forky, sid	2.6.0+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
fluidsynth	source	(unstable)	2.5.6+dfsg-1

Notes

[trixie] - fluidsynth <no-dsa> (Minor issue)
[bookworm] - fluidsynth <postponed> (Only reachable via the fluidsynth shell or TCP command server, which already grants unauthenticated control; one-line fix can ride a future upload)
[bullseye] - fluidsynth <postponed> (Only reachable via the fluidsynth shell or TCP command server, which already grants unauthenticated control; one-line fix can ride a future upload)
https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-mqmq-w63q-cj94
https://github.com/FluidSynth/fluidsynth/pull/1796
Introduced with: https://github.com/FluidSynth/fluidsynth/commit/8131539ad6c37a832bd67ee26791ef8e28259423 (v1.1.2)
Fixed by: https://github.com/FluidSynth/fluidsynth/commit/762a3bd39a431cd45abf3bbcce7286c87909d087 (v2.5.6)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[trixie] - fluidsynth <no-dsa> (Minor issue)[bookworm] - fluidsynth <postponed> (Only reachable via the fluidsynth shell or TCP command server, which already grants unauthenticated control; one-line fix can ride a future upload)[bullseye] - fluidsynth <postponed> (Only reachable via the fluidsynth shell or TCP command server, which already grants unauthenticated control; one-line fix can ride a future upload)https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-mqmq-w63q-cj94https://github.com/FluidSynth/fluidsynth/pull/1796Introduced with: https://github.com/FluidSynth/fluidsynth/commit/8131539ad6c37a832bd67ee26791ef8e28259423 (v1.1.2)Fixed by: https://github.com/FluidSynth/fluidsynth/commit/762a3bd39a431cd45abf3bbcce7286c87909d087 (v2.5.6)

OS impact

Debian Mixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`2.4.4+dfsg-1+deb13u3`
sid	Fixed	`2.5.6+dfsg-1`
forky	Fixed	`2.5.6+dfsg-1`
bullseye	Affected	—
bookworm	Affected	—

References

CWEs

CWE-122

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.