Fluidsynth: From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its… (CVE-2026-61714)
FluidSynth versions from 2.2.4 up to but not including 2.5.6 have a vulnerability where configuring synth.midi-channels above 16 causes out-of-bounds memory access in the MIDI player. This occurs because the player indexes outside the fixed-size heap allocation for tracking active channels, leading to undefined behavior that can compromise confidentiality, integrity, and availability. The issue is triggered by configuration alone, without requiring a crafted MIDI file. The vulnerability is fixed in version 2.5.6.
AI Analysis
Technical Summary
FluidSynth, a software synthesizer, has a vulnerability (CVE-2026-61714) affecting versions from 2.2.4 until 2.5.6. When the synth.midi-channels setting is configured above 16, the MIDI player accesses memory outside the bounds of the _fluid_player_t::channel_isplaying array, which is allocated with a fixed size. This out-of-bounds read and write leads to undefined behavior that may impact confidentiality, integrity, and availability of the system. The unsafe condition arises solely from the channel count configuration, not from any crafted MIDI input. The vulnerability is resolved in FluidSynth version 2.5.6.
Potential Impact
The out-of-bounds memory access caused by configuring synth.midi-channels above 16 can lead to undefined behavior, potentially compromising system confidentiality, integrity, and availability. Since no crafted MIDI file is required, the vulnerability can be triggered by configuration alone, increasing risk. However, exploitation requires local configuration changes and user interaction (UI:R).
Mitigation Recommendations
Upgrade FluidSynth to version 2.5.6 or later, where this vulnerability is fixed. Alternatively, keep the synth.midi-channels configuration at its default value of 16 to avoid triggering the vulnerable code path.
Fluidsynth: From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its… (CVE-2026-61714)
Description
FluidSynth versions from 2.2.4 up to but not including 2.5.6 have a vulnerability where configuring synth.midi-channels above 16 causes out-of-bounds memory access in the MIDI player. This occurs because the player indexes outside the fixed-size heap allocation for tracking active channels, leading to undefined behavior that can compromise confidentiality, integrity, and availability. The issue is triggered by configuration alone, without requiring a crafted MIDI file. The vulnerability is fixed in version 2.5.6.
CVSS v3.1
Score 7.8high
Affected software
pkg:deb/ubuntu/fluidsynth?arch=source&distro=trustypkg:deb/ubuntu/fluidsynth?arch=source&distro=xenialpkg:deb/ubuntu/fluidsynth?arch=source&distro=bionicpkg:deb/ubuntu/fluidsynth?arch=source&distro=focalpkg:deb/ubuntu/fluidsynth?arch=source&distro=jammypkg:deb/ubuntu/fluidsynth?arch=source&distro=noblepkg:deb/ubuntu/fluidsynth?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FluidSynth, a software synthesizer, has a vulnerability (CVE-2026-61714) affecting versions from 2.2.4 until 2.5.6. When the synth.midi-channels setting is configured above 16, the MIDI player accesses memory outside the bounds of the _fluid_player_t::channel_isplaying array, which is allocated with a fixed size. This out-of-bounds read and write leads to undefined behavior that may impact confidentiality, integrity, and availability of the system. The unsafe condition arises solely from the channel count configuration, not from any crafted MIDI input. The vulnerability is resolved in FluidSynth version 2.5.6.
Potential Impact
The out-of-bounds memory access caused by configuring synth.midi-channels above 16 can lead to undefined behavior, potentially compromising system confidentiality, integrity, and availability. Since no crafted MIDI file is required, the vulnerability can be triggered by configuration alone, increasing risk. However, exploitation requires local configuration changes and user interaction (UI:R).
Mitigation Recommendations
Upgrade FluidSynth to version 2.5.6 or later, where this vulnerability is fixed. Alternatively, keep the synth.midi-channels configuration at its default value of 16 to avoid triggering the vulnerable code path.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-61714
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:14.04:LTS","Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ab4be5ef7a7c54106f0aa83
Added to database: 09/24/2026, 06:08:30 UTC
Last enriched: 09/24/2026, 06:49:31 UTC
Last updated: 09/25/2026, 01:47:44 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.