USN-8885-1: FluidSynth vulnerabilities
Ubuntu patched FluidSynth flaws that could crash the synthesizer or allow arbitrary code execution.
Ubuntu Security Notice USN-8885-1 covers two FluidSynth vulnerabilities that a remote attacker could use to crash the software or possibly execute arbitrary code. CVE-2026-58264 is insufficient validation of the channel argument to the pitch_bend_range command. CVE-2026-61714 is a heap buffer overflow in the MIDI player when configurations use more than 16 MIDI channels, and it affects only Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. The notice does not report in-the-wild exploitation.
- CVE-2026-58264: weak pitch_bend_range checks could crash FluidSynth or run code.
- CVE-2026-61714: heap overflow when more than 16 MIDI channels are configured.
- Second flaw affects only Ubuntu 22.04, 24.04, and 26.04 LTS.
- The notice does not report exploitation in the wild.
- Vendors
- Ubuntu
- Products
- FluidSynthUbuntu
- Organizations
- Canonical
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-58264+1 related CVE | Out-of-Bounds Heap Write in FluidSynth pitch_bend_range Command Handler | 9.8 group max | — |
From the original article
It was discovered that FluidSynth did not properly validate the channel argument of the pitch_bend_range command. A remote attacker could possibly use this issue to cause FluidSynth to crash, resulting in a denial of service, or execute arbitrary code.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.