EUVD-2026-83376Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitation depends on a non-default operator-controlled config (synth.midi-channels>16), so PR:L and AC:H; local library path (AV:L) with playback interaction (UI:R) and heap corruption plausibly reaching C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.
AnalysisAI
Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.midi-channels setting is configured above its default of 16, letting a local user who can influence that configuration crash the synthesizer and potentially achieve memory corruption with confidentiality, integrity and availability impact in the playing process. All releases from 2.2.4 up to but not including 2.5.6 are affected; the unsafe state is created by configuration alone plus ordinary playback, so no specially crafted MIDI file is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the FluidSynth configuration setting synth.midi-channels to be set above its default value of 16; the vulnerable out-of-bounds path does not exist at the default of 16. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this 7.8 (High) with AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, but the real-world risk is materially lower than that number implies because exploitation is gated behind a non-default operator configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to FluidSynth 2.5.6 or later, which contains the vendor-released fix (commit 772702e00cc6acc7c607efb40283e2269211effc, release https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6; advisory https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-976m-35rw-h3m6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FluidSynth installations and identify affected releases from 2.2.4 up to but not including 2.5.6, then set synth.midi-channels to 16 or lower wherever operationally feasible and restrict write access to FluidSynth configuration files to trusted administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluidsynth
View allfluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be t
Out-of-bounds heap write in FluidSynth's command handler lets an attacker supply an out-of-range channel argument to the
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. Rated medium severity (CVSS 5.5), this vul
Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-co
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-siz
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application th
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today