FluidSynth, a software synthesizer based on SoundFont 2 specifications, has a vulnerability (CVE-2026-61721) in versions from 2.5.0 until 2.5.6 where the native DLS loader assigns wsmp.loop_start and wsmp.loop_length values from a crafted DLS file to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). This allows sample loop points to be set beyond the sample buffer, resulting in out-of-bounds reads during audio rendering. The flaw can cause undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF are not affected. The issue is resolved in FluidSynth version 2.5.6.

Exploitation of this vulnerability can cause out-of-bounds memory reads during audio rendering, which may lead to undefined behavior, potential disclosure of memory contents, and denial of service conditions. There is no indication of remote exploitability without local access, as the attack vector involves crafted DLS files processed by the native DLS loader.

Upgrade FluidSynth to version 2.5.6 or later, where this vulnerability is fixed. Alternatively, builds compiled with the CMake option enable-native-dls set to OFF are not affected by this issue. Users should verify their build configuration or apply the official update to remediate the vulnerability.