EUVD-2026-83377Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Local crafted file must be loaded by a victim so AV:L and UI:R; pure denial of service means C:N/I:N/A:H with no privileges needed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large connblocks value that wraps the expression and bypasses the chunk-size check, after which the parser performs approximately one billion 12-byte iterations beyond the chunk boundary. The excessive processing and invalid reads can cause denial of service. Builds with the CMake option enable-native-dls set to OFF do not expose the parser. This issue is fixed in version 2.5.6.
AnalysisAI
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted DLS SoundFont file: an integer overflow in the parser's articulation-chunk size check lets the loader run roughly a billion out-of-bounds 12-byte iterations, causing a crash or hang. The flaw affects versions 2.5.0 through 2.5.5 and is fixed in 2.5.6; exploitation requires the target to be built with the non-default CMake option enable-native-dls set to ON and to load the attacker-supplied file (unauthenticated per the CVSS PR:N vector, but the attack vector is local and the malicious file must reach the application). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a FluidSynth build compiled with the CMake option enable-native-dls set to ON - builds with it OFF do not compile the vulnerable native DLS parser and are not exposed; and (2) the victim application to load an attacker-supplied crafted DLS SoundFont file whose articulation chunk specifies a large connblocks value that overflows the 32-bit cbsize + connblocks * 12 expression. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine-but-modest-priority issue best characterized as a high-CVSS-but-limited-real-risk local denial of service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to FluidSynth 2.5.6, which contains the guard that rejects oversized ConnectionBlock counts before the size comparison is evaluated (vendor-released patch: 2.5.6, per https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6 and commit 4d7084fca7c876f5d738498b4917a39faf603425). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluidsynth
View allfluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be t
Out-of-bounds heap write in FluidSynth's command handler lets an attacker supply an out-of-range channel argument to the
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. Rated medium severity (CVSS 5.5), this vul
Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-co
Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-siz
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application th
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today