EUVD-2026-83375Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
File must be loaded locally (AV:L) and requires a user/pipeline to open it (UI:R); OOB read yields partial memory disclosure (C:L), reliable crash (A:H), no integrity impact (I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.
AnalysisAI
Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-controlled DLS soundfont, allowing memory disclosure and denial of service. Only builds compiled with the CMake option enable-native-dls enabled expose the vulnerable loader in src/sfloader/fluid_dls.cpp; builds with that option set to OFF are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a FluidSynth build compiled with the CMake option enable-native-dls (the native DLS loader in src/sfloader/fluid_dls.cpp) - builds with enable-native-dls=OFF do not expose the parser and are not affected; (2) an affected version in the range 2.5.0 through 2.5.5; and (3) the target to load and render an attacker-controlled DLS file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS is 8.0 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to FluidSynth 2.5.6 (vendor-released patch), which sanitizes wsmp loop points via fluid_sample_sanitize_loop() and validates each sample with fluid_sample_validate() before it is retained; see advisory GHSA-59ph-rx8r-8p4j, commit 2354c2a9acdb26de7cdcd37c903ee108f46c0a7d, and release tag v2.5.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of FluidSynth and determine build configuration, since only builds compiled with the 'enable-native-dls' CMake option contain the vulnerable loader in src/sfloader/fluid_dls.cpp and builds with that option set to OFF are unaffected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluidsynth
View allfluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be t
Out-of-bounds heap write in FluidSynth's command handler lets an attacker supply an out-of-range channel argument to the
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. Rated medium severity (CVSS 5.5), this vul
Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-siz
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application th
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today