EUVD-2026-83378Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Local vector because a crafted DLS file must be parsed, UI:R since a user/service must load it, DoS-only so A:H with C:N and I:N (no proven integrity impact).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.
AnalysisAI
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-size check, triggering an approximately 4 GB pool-cue allocation and billions of out-of-bounds reads that crash the process, producing a denial of service against the affected 2.5.0 through 2.5.5 releases. Exploitation requires the library to be built with enable-native-dls=ON and an attacker-supplied DLS file to be opened by the application; the CVSS vector indicates no privileges are required (PR:N), and no public exploit code was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires FluidSynth built with enable-native-dls=ON (the native DLS parser); builds with enable-native-dls=OFF are explicitly not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, 6.8 Medium) and CWE-190 (Integer Overflow) are internally consistent with the description: a 32-bit unsigned multiply-add wrap (cues * 4 + cbsize) bypasses the chunk-size check, driving a ~4GB allocation and out-of-bounds reads that crash the process - a pure availability/DoS impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: FluidSynth 2.5.6, which contains commit a2ab32b9c3b9f8845b7254adea73c211f6c5a24c adding the overflow check on the ptbl cue count; upgrade to 2.5.6 or later, and rebuild any application that statically links or vendors FluidSynth against that version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluidsynth
View allfluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be t
Out-of-bounds heap write in FluidSynth's command handler lets an attacker supply an out-of-range channel argument to the
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. Rated medium severity (CVSS 5.5), this vul
Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-co
Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application th
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today