FluidSynth, a software synthesizer based on SoundFont 2 specifications, has an integer overflow vulnerability in its native DLS parser in versions 2.5.0 through 2.5.5. The parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without ensuring the multiplication and addition fit within 32 bits. A crafted DLS file can supply a large connblocks value causing the expression to wrap around, bypassing the chunk-size check. This results in the parser performing approximately one billion 12-byte iterations beyond the chunk boundary, leading to excessive processing and invalid memory reads that cause denial of service. The vulnerability is resolved in FluidSynth version 2.5.6. Builds with the native DLS parser disabled (enable-native-dls=OFF) are not affected.

The vulnerability allows denial of service via a crafted DLS file that triggers excessive processing and invalid memory reads in the FluidSynth native DLS parser. There is no impact on confidentiality or integrity reported. The denial of service can disrupt applications using the affected FluidSynth versions with the native DLS parser enabled.

Upgrade FluidSynth to version 2.5.6 or later where this issue is fixed. Alternatively, disable the native DLS parser by building FluidSynth with the CMake option enable-native-dls set to OFF, which prevents exposure to this vulnerability.