EUVD-2026-83374Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In TCP-server mode the command handler is unauthenticated and network-reachable (AV:N/PR:N/AC:L); heap OOB write supports DoS and possible code execution, so C/I/A:H, though this assumes the non-default server configuration.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.
AnalysisAI
Out-of-bounds heap write in FluidSynth's command handler lets an attacker supply an out-of-range channel argument to the pitch_bend_range command, which is written through the selected synth channel without bounds checking. The worst-case exposure is unauthenticated remote code execution or denial of service (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) when FluidSynth runs as a TCP command server via new_fluid_server() or 'fluidsynth -s'; absent that network mode, the flaw is only locally reachable through malicious commands fed to the interactive shell on standard input, and applications that embed the library without the shell, command handler, or TCP server are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote exploitation REQUIRES FluidSynth to be running with its TCP command server enabled via new_fluid_server() or the 'fluidsynth -s' flag - this is a non-default operating mode, and that server historically exposes the command handler without authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) reflects the WORST-CASE deployment: FluidSynth running as a network TCP server (new_fluid_server()/fluidsynth -s), which historically has no authentication, exposing the vulnerable pitch_bend_range command handler to unauthenticated remote input. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to FluidSynth 2.5.6, the vendor-released patch version that adds the missing channel bounds check in fluid_handle_pitch_bend_range() (fix available via release https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6, PR https://github.com/FluidSynth/fluidsynth/pull/1796, and commit 762a3bd39a431cd45abf3bbcce7286c87909d087; see also advisory GHSA-mqmq-w63q-cj94). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every host and product that runs FluidSynth with the command handler exposed - specifically anything launched as 'fluidsynth -s' or via new_fluid_server(), including containers, embedded audio appliances, and developer workstations - and immediately block external and cross-segment access to the FluidSynth command port, bind it to loopback, or stop the service outright until it can be upgraded; also flag any pipeline that feeds untrusted input to the interactive shell on standard input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluidsynth
View allfluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be t
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. Rated medium severity (CVSS 5.5), this vul
Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-co
Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-siz
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application th
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today