Executive brief
FluidSynth is a software music synthesizer that plays audio based on SoundFont files. Versions 2.5.0 through 2.5.5 contain a flaw in how they handle specially crafted DLS audio files: malicious loop point values can be placed outside the audio buffer boundaries, leading to memory corruption, information leakage, or application crashes during playback.
Technical details
The native DLS file loader fails to validate sample loop start and loop length values from the wsmp chunk before use, allowing out-of-bounds read access during audio rendering. The vulnerability affects the fluid_dls.cpp parser when the CMake option enable-native-dls is set to ON (default). An attacker can craft a malicious DLS file that triggers heap buffer reads beyond allocated boundaries, potentially disclosing sensitive memory or causing denial of service.
Affected products
- FluidSynth FluidSynth 2.5.0 to 2.5.5
Timeline
- 2026-09-18: disclosed
- 2026-07-04: patched: Fixed in version 2.5.6