CVE-2026-61714

high

Published 2026-09-18 · Modified 2026-09-18

Discuss on Community Propose mitigation

CVSS v3

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.8

Description

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-61714 NameCVE-2026-61714 Descriptionheap-based buffer overflow in MIDI player SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus fluidsynth…

CVE-2026-61714

Name	CVE-2026-61714
Description	heap-based buffer overflow in MIDI player
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fluidsynth (PTS)	bullseye	2.1.7-1.1	fixed
	bookworm	2.3.1-2	vulnerable
	trixie	2.4.4+dfsg-1+deb13u2	vulnerable
	forky, sid	2.5.7+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
fluidsynth	source	bullseye	(not affected)
fluidsynth	source	(unstable)	2.5.6+dfsg-1

Notes

[trixie] - fluidsynth <no-dsa> (Minor issue)
[bookworm] - fluidsynth <postponed> (Needs a non-default synth.midi-channels > 16; MIDI file channels are masked to 4 bits so a crafted file cannot reach it)
[bullseye] - fluidsynth <not-affected> (Vulnerable code not present)
https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-976m-35rw-h3m6
Introduced with: https://github.com/FluidSynth/fluidsynth/commit/6c593180ce05f8bbbd07217456bc4376a4ab4505 (v2.2.4)
Fixed by: https://github.com/FluidSynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc (v2.5.6)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[trixie] - fluidsynth <no-dsa> (Minor issue)[bookworm] - fluidsynth <postponed> (Needs a non-default synth.midi-channels > 16; MIDI file channels are masked to 4 bits so a crafted file cannot reach it)[bullseye] - fluidsynth <not-affected> (Vulnerable code not present)https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-976m-35rw-h3m6Introduced with: https://github.com/FluidSynth/fluidsynth/commit/6c593180ce05f8bbbd07217456bc4376a4ab4505 (v2.2.4)Fixed by: https://github.com/FluidSynth/fluidsynth/commit/772702e00cc6acc7c607efb40283e2269211effc (v2.5.6)

OS impact

Debian Mixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`2.4.4+dfsg-1+deb13u3`
sid	Fixed	`2.5.6+dfsg-1`
forky	Fixed	`2.5.6+dfsg-1`
bullseye	Fixed	`0`
bookworm	Affected	—

References

CWEs

CWE-122 CWE-125 CWE-787

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.