FluidSynth, a software synthesizer, has a vulnerability in its native DLS parser in versions 2.5.0 through 2.5.5. The parser validates ptbl chunks using an unsigned expression 'cues * 4 + cbsize' without checking for 32-bit overflow. A crafted DLS file can supply a large 'cues' value that causes integer wraparound, passing the chunk-size check incorrectly. This leads to a call to poolcues.resize(cues) requesting approximately 4GB of memory and reading billions of entries beyond the chunk boundary, resulting in denial of service. The vulnerability is fixed in FluidSynth 2.5.6. Builds compiled with native DLS parsing disabled are not vulnerable.

An attacker can supply a malicious DLS file that triggers excessive memory allocation and out-of-bounds reads in the FluidSynth native DLS parser, causing a denial of service. There is no indication of confidentiality or integrity impact. The vulnerability requires local access to supply the crafted file and has low attack complexity with no privileges required.

Upgrade FluidSynth to version 2.5.6 or later where this vulnerability is fixed. Alternatively, use builds with native DLS parsing disabled (enable-native-dls set to OFF), which are not exposed to this issue. No other mitigation is indicated by the vendor advisory.