USN-8885-1: FluidSynth vulnerabilities
Ubuntu patched FluidSynth flaws that could crash the synthesizer or allow arbitrary code execution.
34
Vulnerability1 · 1 read
CVE-2026-58264
Out-of-Bounds Heap Write in FluidSynth pitch_bend_range Command Handler
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
FluidSynth versions 1.1.2 through 2.5.5 fail to bounds-check the channel argument of the pitch_bend_range command in its built-in command handler, so an out-of-range channel index triggers an out-of-bounds heap write. An attacker can trigger this remotely if the built-in TCP server is enabled (fluidsynth -s or new_fluid_server()), or locally by feeding malicious commands to the FluidSynth shell on standard input. Successful exploitation can crash the synthesizer (denial of service) and may allow arbitrary code execution. Only deployments that use the command handler, shell, or TCP server are affected; applications that merely use FluidSynth as a rendering library without these interfaces are not exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is fixed in version 2.5.6.
What to do: Upgrade FluidSynth to version 2.5.6 or later. Where upgrading is not possible, do not run fluidsynth -s or create servers via new_fluid_server(), disable the command shell/stdin handler in embedded applications, and firewall any exposed synthesizer port. Developers should also validate channel arguments passed to the command handler in custom integrations.
| Product | Affected |
|---|---|
| FluidSynth | >= 1.1.2, < 2.5.6 (fixed in 2.5.6) |
Estimated exposure
nichelikely thousands or fewer remotely reachable instances; the library is mass-bundled but only the optional TCP server/shell path is exploitable — FluidSynth ships in most Linux distributions and is embedded in many media players, MIDI apps, and games (millions of installs), but the flaw is only reachable when the TCP server (fluidsynth -s / new_fluid_server()) or interactive shell…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.
- Weakness
- CWE-122
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H