EUVD-2026-83379Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local SF2 file parsing (AV:L) with trivial trigger (AC:L), no privileges, and availability-only memory-exhaustion impact (C:N/I:N/A:H); retained UI:N per vendor though file load arguably implies interaction.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.
AnalysisAI
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application that parses an attacker-supplied SoundFont 2 file. The SF2 parser derives the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without first rejecting chunks smaller than a single record, so a zero-sized DMOD chunk underflows the unsigned subtraction to UINT_MAX and the loader attempts to allocate billions of SFMod structures until process memory is exhausted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to load an attacker-crafted SF2 (SoundFont 2) file whose DMOD chunk is smaller than one SF_MOD_SIZE record (specifically a zero-sized DMOD chunk) using an unpatched FluidSynth between 2.5.0 and 2.5.5. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-priority availability issue, not a high-real-risk emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to FluidSynth 2.5.6, the vendor-released patch version that adds the missing chunk.size < SF_MOD_SIZE lower-bound check in src/sfloader/fluid_sffile.c (fix commit 096e1ff0d09ddcac83d94923440706f76f94bc44, advisory GHSA-rmc4-c8hw-455w); 2.5.6 is the only confirmed remediation and no upstream workaround is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluidsynth
View allfluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be t
Out-of-bounds heap write in FluidSynth's command handler lets an attacker supply an out-of-range channel argument to the
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. Rated medium severity (CVSS 5.5), this vul
Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-co
Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-siz
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted
Same weakness CWE-191 – Integer Underflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today