CVE-2025-68617

Fluidsynth version 2.4.6 and earlier is vulnerable to a null pointer dereference in fluid_synth_monopoly.c, which can be triggered when loading an invalid MIDI file.

FluidSynth from 1.1.2 to 2.5.6 has an out-of-bounds heap write vulnerability in the pitch_bend_range command handler where the channel argument is not bounds checked. This can lead to denial of service or potential code execution. The issue is remotely reachable via the TCP server or locally via the FluidSynth shell.

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where ptbl chunk validation uses the expression cues * 4 + cbsize without checking for 32-bit overflow. A crafted DLS file can wrap the expression and pass the chunk-size check, causing poolcues.resize(cues) to request about four gigabytes and read billions of entries beyond the chunk boundary.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where articulation chunk validation uses the expression cbsize + connblocks * 12 without checking for 32-bit overflow. A crafted DLS file can wrap the expression and bypass the chunk-size check, leading to approximately one billion 12-byte iterations beyond the chunk boundary.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the SF2 parser where the DMOD modulator count is computed as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file with a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations.

FluidSynth from 2.2.4 to 2.5.6 contains a vulnerability related to configuring synth.midi-channels above 16, allowing out-of-bounds reads and writes in the _fluid_player_t::channel_isplaying structure. This can lead to undefined behavior and compromise confidentiality, integrity, or availability. The issue is fixed in version 2.5.6.