FluidSynth CVE-2026-111123

Exploitation requires the victim to load and play an attacker-crafted SF2 SoundFont file in which PMOD or IMOD modulator destination values are set to 63-255; these out-of-range destinations are not validated before indexing the voice generator array. Key limiting factors: the attack vector is local (AV:L) and requires user interaction (UI:P) - the malicious SoundFont must be delivered to and opened/played by a user or an application acting on their behalf - so there is no remote, unauthenticated, default-configuration path. Any FluidSynth-based application (version through 2.6.1) that accepts externally supplied SF2/MIDI content is exposed; the realistic impact is memory corruption and crashes (availability), with no confidentiality impact.

This is a medium-severity memory-corruption issue (CVSS 4.0 base 6.9) whose signals point to limited, non-urgent real-world risk rather than a top priority. The provided CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H: local attack vector with required (passive) user interaction, no privileges, and impact dominated by availability (VA:H, i.e. crashes) plus limited integrity (VI:L) and no confidentiality loss - consistent with CWE-787 heap/stack out-of-bounds writes triggered by parsing attacker-supplied data. No EPSS score is supplied, there is no CISA KEV listing in the input, and no explicit POC/exploit-code flag is provided; a third-party technical write-up (hackmd) and vendor advisory (VulnCheck) describe the bug and precise code locations but do not amount to a confirmed weaponized exploit. The exploitation status is therefore 'no public exploit identified at time of analysis.' The main limiting factor is that exploitation is not remote-automatable: a victim must load and play a malicious SF2 SoundFont, so this is a classic file-parsing / client-side issue, not a wormable network flaw. Realistic worst case is memory corruption with potential for limited code influence, but the CVSS impact profile and attack model suggest denial-of-service (crash) is the most likely outcome. No key signals are strongly conflicting; the primary gap is the absence of EPSS/KEV/POC data to confirm whether any active exploitation exists.

An attacker crafts a malicious SF2 SoundFont file containing PMOD/IMOD modulator destination values in the range 63-255. A victim using an application built on FluidSynth opens and plays the file (or a MIDI track referencing it), causing FluidSynth to write past the voice generator array and updated_gen_bit, corrupting heap and stack memory and typically crashing the process. No public exploit code is identified in the input; a technical analysis write-up exists but active exploitation is not confirmed.