Executive brief
FluidSynth is a software synthesizer that processes SoundFont 2 files to generate audio. A malicious SF2 file with a zero-sized DMOD chunk causes an integer underflow that triggers billions of memory allocations, exhausting available memory and crashing the application. An attacker can exploit this by tricking a user or system into opening a crafted audio file, resulting in a denial of service.
Technical details
The SF2 parser in FluidSynth 2.5.0–2.5.5 calculates the modulator count as chunk.size / SF_MOD_SIZE - 1 without validating that the chunk is at least one record in size. When chunk.size is zero, the unsigned arithmetic wraps to UINT_MAX, causing the parser to attempt massive memory allocations. The vulnerability exists in the DMOD chunk processing code and requires only network or local delivery of a crafted SF2 file; no authentication or user interaction is needed beyond opening the file.
Affected products
- FluidSynth FluidSynth 2.5.0 to 2.5.5
Timeline
- 2026-09-18: disclosed
- 2026-07-04: patched: Fixed in version 2.5.6