CVE-2026-61714

FluidSynth, an open-source SoundFont 2 software synthesizer widely embedded in media players, DAWs, and MIDI applications, contains a heap-based out-of-bounds read and write (CWE-122/125/787) in its MIDI player. When the synth.midi-channels setting is raised above the default of 16, the player indexes the fixed-size _fluid_player_t::channel_isplaying heap array beyond its bounds while tracking active channels, so no crafted MIDI file is required to reach the flaw. The resulting out-of-bounds write can crash the host application and, per the advisory, may compromise confidentiality, integrity, or availability (CVSS 7.8, local attack vector requiring user interaction). Anyone running FluidSynth 2.2.4 through 2.5.5 in a configuration with more than 16 MIDI channels is affected, including desktop, packaged, and embedded builds, while default-configuration users are not on the vulnerable path. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation has been reported; version 2.5.6 contains the fix.

What to do: Upgrade to FluidSynth 2.5.6 or later and rebuild or repackage dependent applications. Until patched, keep synth.midi-channels at its default of 16 in standalone players, media-player MIDI plugins, and embedded builds, and audit config files or launch flags that raise the channel count. Downstream packagers and app developers should verify which bundled libfluidsynth version they ship.