# CVE-2025-68617: FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a…

Source: https://junglewise.ai/threats/cve-2025-68617-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-23  
License: CC BY 4.0 with a link back

CVE-2025-68617 · Severity: high · CVSS 7 · Published 2025-12-23

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support.

Technologies: [FluidSynth](https://junglewise.ai/threats/technologies/fluidsynth). Vendors: [FluidSynth](https://junglewise.ai/threats/vendors/fluidsynth).

## Quick answers

**Is CVE-2025-68617 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68617 being exploited in the wild.

**How severe is CVE-2025-68617?** High severity, with a CVSS score of 7, published 23 December 2025.

**Which products and versions are affected?** FluidSynth. The advisory does not name versions.

**Is there a fix for CVE-2025-68617?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-68617?** Check whether you run FluidSynth. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- FluidSynth

## Related threats

- [FluidSynth DLS parser integer overflow](https://junglewise.ai/threats/cve-2026-61723-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth DLS articulation chunk integer overflow](https://junglewise.ai/threats/cve-2026-61722-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth DLS loader buffer overrun in sample loop processing](https://junglewise.ai/threats/cve-2026-61721-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth SF2 DMOD chunk integer underflow](https://junglewise.ai/threats/cve-2026-61720-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth heap buffer overflow in MIDI player channel indexing](https://junglewise.ai/threats/cve-2026-61714-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)