# CVE-2026-61720: FluidSynth SF2 DMOD chunk integer underflow

Source: https://junglewise.ai/threats/cve-2026-61720-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-61720 · Severity: medium · CVSS 6.2 · Published 2026-09-18

FluidSynth is a software synthesizer that processes SoundFont 2 files to generate audio. A malicious SF2 file with a zero-sized DMOD chunk causes an integer underflow that triggers billions of memory allocations, exhausting available memory and crashing the application. An attacker can exploit this by tricking a user or system into opening a crafted audio file, resulting in a denial of service.

Technologies: [FluidSynth](https://junglewise.ai/threats/technologies/fluidsynth). Vendors: [FluidSynth](https://junglewise.ai/threats/vendors/fluidsynth).

## Quick answers

**Is CVE-2026-61720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61720 being exploited in the wild.

**How severe is CVE-2026-61720?** Medium severity, with a CVSS score of 6.2, published 18 September 2026.

**Which products and versions are affected?** FluidSynth 2.5.0 to 2.5.5.

**Is there a fix for CVE-2026-61720?** A patch was published on 2026-07-04: Fixed in version 2.5.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61720 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-61720?** Check whether you run FluidSynth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SF2 parser in FluidSynth 2.5.0–2.5.5 calculates the modulator count as chunk.size / SF_MOD_SIZE - 1 without validating that the chunk is at least one record in size. When chunk.size is zero, the unsigned arithmetic wraps to UINT_MAX, causing the parser to attempt massive memory allocations. The vulnerability exists in the DMOD chunk processing code and requires only network or local delivery of a crafted SF2 file; no authentication or user interaction is needed beyond opening the file.

## Affected products

- FluidSynth FluidSynth 2.5.0 to 2.5.5

## Timeline

- 2026-09-18: disclosed
- 2026-07-04: patched: Fixed in version 2.5.6

## References

- [https://github.com/FluidSynth/fluidsynth/commit/096e1ff0d09ddcac83d94923440706f76f94bc44](https://github.com/FluidSynth/fluidsynth/commit/096e1ff0d09ddcac83d94923440706f76f94bc44)
- [https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6](https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6)

## Related threats

- [FluidSynth DLS parser integer overflow](https://junglewise.ai/threats/cve-2026-61723-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth DLS articulation chunk integer overflow](https://junglewise.ai/threats/cve-2026-61722-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth DLS loader buffer overrun in sample loop processing](https://junglewise.ai/threats/cve-2026-61721-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth heap buffer overflow in MIDI player channel indexing](https://junglewise.ai/threats/cve-2026-61714-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth heap buffer overflow in pitch_bend_range command](https://junglewise.ai/threats/cve-2026-58264-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)