CVE-2026-61720
FluidSynth: SF2 DMOD Chunk Unsigned Underflow
CVSS Score
6.2
EPSS Score
0.0%
EPSS Percentile
0th
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.
| CWE | CWE-191 |
| Vendor | fluidsynth |
| Product | fluidsynth |
| Published | Sep 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for fluidsynth fluidsynth
Be the first to know when new medium vulnerabilities affecting fluidsynth fluidsynth are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
FluidSynth / fluidsynth
>= 2.5.0, < 2.5.6