# CVE-2026-61721: FluidSynth DLS loader buffer overrun in sample loop processing

Source: https://junglewise.ai/threats/cve-2026-61721-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-61721 · Severity: high · CVSS 8 · Published 2026-09-18

FluidSynth is a software music synthesizer that plays audio based on SoundFont files. Versions 2.5.0 through 2.5.5 contain a flaw in how they handle specially crafted DLS audio files: malicious loop point values can be placed outside the audio buffer boundaries, leading to memory corruption, information leakage, or application crashes during playback.

Technologies: [FluidSynth](https://junglewise.ai/threats/technologies/fluidsynth). Vendors: [FluidSynth](https://junglewise.ai/threats/vendors/fluidsynth).

## Quick answers

**Is CVE-2026-61721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61721 being exploited in the wild.

**How severe is CVE-2026-61721?** High severity, with a CVSS score of 8, published 18 September 2026.

**Which products and versions are affected?** FluidSynth 2.5.0 to 2.5.5.

**Is there a fix for CVE-2026-61721?** A patch was published on 2026-07-04: Fixed in version 2.5.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61721 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-61721?** Check whether you run FluidSynth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The native DLS file loader fails to validate sample loop start and loop length values from the wsmp chunk before use, allowing out-of-bounds read access during audio rendering. The vulnerability affects the fluid_dls.cpp parser when the CMake option enable-native-dls is set to ON (default). An attacker can craft a malicious DLS file that triggers heap buffer reads beyond allocated boundaries, potentially disclosing sensitive memory or causing denial of service.

## Affected products

- FluidSynth FluidSynth 2.5.0 to 2.5.5

## Timeline

- 2026-09-18: disclosed
- 2026-07-04: patched: Fixed in version 2.5.6

## References

- [https://github.com/FluidSynth/fluidsynth/commit/2354c2a9acdb26de7cdcd37c903ee108f46c0a7d](https://github.com/FluidSynth/fluidsynth/commit/2354c2a9acdb26de7cdcd37c903ee108f46c0a7d)
- [https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6](https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6)

## Related threats

- [FluidSynth DLS parser integer overflow](https://junglewise.ai/threats/cve-2026-61723-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth DLS articulation chunk integer overflow](https://junglewise.ai/threats/cve-2026-61722-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth SF2 DMOD chunk integer underflow](https://junglewise.ai/threats/cve-2026-61720-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth heap buffer overflow in MIDI player channel indexing](https://junglewise.ai/threats/cve-2026-61714-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth heap buffer overflow in pitch_bend_range command](https://junglewise.ai/threats/cve-2026-58264-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)