Executive brief
FluidSynth is a software synthesizer that processes MIDI music files using SoundFont 2 specifications. Versions 2.2.4 through 2.5.5 contain a heap buffer overflow flaw that occurs when the MIDI channel configuration exceeds the default of 16 channels, potentially allowing an attacker to read or write memory outside the intended buffer, risking data corruption, information disclosure, or application crashes.
Technical details
An out-of-bounds heap buffer access occurs in the MIDI player's channel tracking when synth.midi-channels is configured above 16, causing reads and writes to exceed the fixed-size allocation for the _fluid_player_t::channel_isplaying array. The vulnerability is triggered by configuration alone without requiring a crafted MIDI file. The issue is fixed in FluidSynth 2.5.6 through bounds-checking on channel indexing.
Affected products
- FluidSynth FluidSynth 2.2.4 to 2.5.5
Timeline
- 2026-09-18: disclosed
- 2026-07-04: patched: Fixed in version 2.5.6