FluidSynth CVE-2025-68617

Requires FluidSynth built WITH native DLS support (builds compiled without native DLS support are entirely unaffected), running an affected version 2.5.0 through 2.5.1. The flaw triggers only in a multithreaded condition: a thread pending to unload a DLS file races against either concurrent synthesizer destruction OR concurrent audio synthesis that still uses samples from the file being unloaded. LIMITING FACTORS: exploitation needs local access to (or control over) the host application's DLS load/unload and synthesis lifecycle, precise thread timing to win the race (hence AC:H), and application-driven user interaction (UI:R). The bug does NOT occur when a DLS file is explicitly unloaded before synth destruction provided no active voices are using that file's samples at unload time.

This is a genuine but conditional memory-safety flaw, not a top-tier emergency. The vendor-assigned CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.0 High) is internally consistent with the description: exploitation is LOCAL (AV:L), requires winning a concurrency race (AC:H), needs the victim application to perform specific actions such as loading/unloading a DLS file (UI:R), but needs no prior authentication (PR:N). A publicly available exploit/repro exists (GitHub issue #1717 is flagged as an exploit), which raises practical concern, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active, widespread exploitation - exploitation status is 'publicly available exploit code exists' and must NOT be conflated with in-the-wild use. SSVC-style reasoning: technical impact is total (C/I/A all High, consistent with a heap use-after-free that can corrupt memory), but the attack is NOT automatable - it depends on a non-deterministic thread-timing race (AC:H) triggered by application-controlled load/unload operations, so this is realistically a targeted or local-abuse scenario rather than a mass-exploitable remote bug. The CVSS High (7.0) therefore somewhat overstates real-world urgency for most deployments because the local vector, high attack complexity, and required user/application interaction sharply narrow who can trigger it. Note one caveat to verify: the raw CVSS is vendor-reported and EPSS is absent, so the exploitation-likelihood signal is incomplete.

An application embedding FluidSynth (compiled with native DLS support, versions 2.5.0 up to but not including 2.5.2) unloads a DLS SoundFont while, on another thread, the synthesizer is being destroyed or voices are still rendering audio from that file's samples. The race causes one thread to use heap memory already freed by the other, corrupting the heap and potentially enabling crash or code execution. A public reproducer exists in the project's issue tracker, though triggering requires precise thread timing (AC:H) and local control over the host application's DLS operations.