# CVE-2026-61722: FluidSynth DLS articulation chunk integer overflow

Source: https://junglewise.ai/threats/cve-2026-61722-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-61722 · Severity: medium · CVSS 6.8 · Published 2026-09-18

FluidSynth is a software synthesizer that processes SoundFont files and related formats used in music production and playback. A flaw in the native DLS file parser allows an attacker to craft a malicious DLS file that causes excessive processing and memory reads, leading to denial of service. This affects synthesizer-dependent applications when processing untrusted audio files.

Technologies: [FluidSynth](https://junglewise.ai/threats/technologies/fluidsynth). Vendors: [FluidSynth](https://junglewise.ai/threats/vendors/fluidsynth).

## Quick answers

**Is CVE-2026-61722 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61722 being exploited in the wild.

**How severe is CVE-2026-61722?** Medium severity, with a CVSS score of 6.8, published 18 September 2026.

**Which products and versions are affected?** FluidSynth 2.5.0 to 2.5.5.

**Is there a fix for CVE-2026-61722?** A patch was published on 2026-07-04: version 2.5.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61722 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61722?** Check whether you run FluidSynth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DLS parser performs an unsigned integer arithmetic operation (cbsize + connblocks * 12) without validating for 32-bit overflow, allowing a large connblocks value to wrap the result and bypass chunk-size validation. An attacker can trigger approximately one billion invalid 12-byte memory iterations past the chunk boundary, causing excessive CPU usage and invalid memory access. The vulnerability is fixed in version 2.5.6 and does not affect builds compiled with enable-native-dls disabled.

## Affected products

- FluidSynth FluidSynth 2.5.0 to 2.5.5

## Timeline

- 2026-09-18: disclosed
- 2026-07-04: patched: version 2.5.6 released

## References

- [https://github.com/FluidSynth/fluidsynth/commit/4d7084fca7c876f5d738498b4917a39faf603425](https://github.com/FluidSynth/fluidsynth/commit/4d7084fca7c876f5d738498b4917a39faf603425)
- [https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6](https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6)

## Related threats

- [FluidSynth DLS parser integer overflow](https://junglewise.ai/threats/cve-2026-61723-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth DLS loader buffer overrun in sample loop processing](https://junglewise.ai/threats/cve-2026-61721-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth SF2 DMOD chunk integer underflow](https://junglewise.ai/threats/cve-2026-61720-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth heap buffer overflow in MIDI player channel indexing](https://junglewise.ai/threats/cve-2026-61714-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)
- [FluidSynth heap buffer overflow in pitch_bend_range command](https://junglewise.ai/threats/cve-2026-58264-fluidsynth-is-a-software-synthesizer-based-on-the-soundfont-2)