Executive brief
FluidSynth is a software synthesizer that processes SoundFont files and related formats used in music production and playback. A flaw in the native DLS file parser allows an attacker to craft a malicious DLS file that causes excessive processing and memory reads, leading to denial of service. This affects synthesizer-dependent applications when processing untrusted audio files.
Technical details
The DLS parser performs an unsigned integer arithmetic operation (cbsize + connblocks * 12) without validating for 32-bit overflow, allowing a large connblocks value to wrap the result and bypass chunk-size validation. An attacker can trigger approximately one billion invalid 12-byte memory iterations past the chunk boundary, causing excessive CPU usage and invalid memory access. The vulnerability is fixed in version 2.5.6 and does not affect builds compiled with enable-native-dls disabled.
Affected products
- FluidSynth FluidSynth 2.5.0 to 2.5.5
Timeline
- 2026-09-18: disclosed
- 2026-07-04: patched: version 2.5.6 released