CVE-2026-61714: FluidSynth Buffer Overflow Vulnerability

CVE-2026-61714 Overview

FluidSynth is an open-source software synthesizer based on the SoundFont 2 specifications. A heap buffer overflow [CWE-122] affects versions 2.2.4 through 2.5.5. When the synth.midi-channels setting is configured above the default value of 16, the MIDI player indexes the _fluid_player_t::channel_isplaying array outside its fixed-size heap allocation. The out-of-bounds reads and writes trigger undefined behavior that may compromise confidentiality, integrity, or availability. Notably, no crafted MIDI file is required to trigger the condition. The unsafe state is created solely by the channel-count configuration itself. FluidSynth version 2.5.6 resolves the issue.

Critical Impact

Local exploitation can lead to memory corruption affecting confidentiality, integrity, and availability of the host application embedding FluidSynth.

Affected Products

• FluidSynth 2.2.4 through 2.5.5
• Applications embedding vulnerable FluidSynth builds with synth.midi-channels above 16
• Linux distributions and downstream packages shipping affected FluidSynth versions

Discovery Timeline

• 2026-09-18 - CVE-2026-61714 published to the National Vulnerability Database
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61714

Vulnerability Analysis

The vulnerability resides in the FluidSynth MIDI player component within src/midi/fluid_midi.c. The player allocates the channel_isplaying tracking array based on the compile-time constant MAX_NUMBER_OF_CHANNELS, which is fixed at 16. However, the runtime setting synth.midi-channels permits values greater than 16. When a MIDI event references a channel index beyond the allocated bounds, the player writes and reads outside the heap allocation.

The result is a classic heap buffer overflow classified under [CWE-122]. Because the trigger is purely configuration-driven, the vulnerable path executes on any MIDI event dispatched to a channel index above 15.

Root Cause

The player uses event->channel directly as an index into player->channel_isplaying[] without bounding the index to the array's fixed size. The mismatch between the configurable channel count and the static allocation size produces the out-of-bounds access.

Attack Vector

Exploitation requires local access and user interaction, consistent with a workflow where an operator loads a MIDI file into an application that has been configured with more than 16 MIDI channels. No specially crafted media file is required. The vulnerable behavior surfaces from ordinary MIDI playback under the misconfiguration.

// Security patch from src/midi/fluid_midi.c
// Bounds the channel index using modulo against the fixed allocation size
         {
             if(player->playback_callback)
             {
+                int *chan_is_playing = &player->channel_isplaying[event->channel % MAX_NUMBER_OF_CHANNELS];
                 player->playback_callback(player->playback_userdata, event);
-                if(event->type == NOTE_ON && event->param2 != 0 && !player->channel_isplaying[event->channel])
+                if(event->type == NOTE_ON && event->param2 != 0 && !*chan_is_playing)
                 {
-                    player->channel_isplaying[event->channel] = TRUE;
+                    *chan_is_playing = TRUE;
                 }
             }
         }

Source: FluidSynth commit 772702e

Detection Methods for CVE-2026-61714

Indicators of Compromise

• Application crashes or aborts in processes linking libfluidsynth during MIDI playback
• AddressSanitizer or heap protector reports referencing channel_isplaying in fluid_midi.c
• Configuration files or command-line invocations setting synth.midi-channels to a value greater than 16

Detection Strategies

• Inventory installed FluidSynth binaries and shared libraries and compare versions against the fixed release 2.5.6
• Scan application configuration for the synth.midi-channels setting exceeding 16
• Enable heap protection features such as glibc MALLOC_CHECK_ or compile with -fsanitize=address in test environments to surface the overflow

Monitoring Recommendations

• Collect process crash telemetry from Linux endpoints that host audio production or MIDI-processing workloads
• Alert on unexpected termination of processes loading libfluidsynth.so and correlate with recent configuration changes
• Track package management events that install or downgrade FluidSynth to versions in the vulnerable range

How to Mitigate CVE-2026-61714

Immediate Actions Required

• Upgrade FluidSynth to version 2.5.6 or later on all affected systems
• Audit application and system-wide configuration files for synth.midi-channels values above 16 and reset them to the default
• Rebuild any downstream software that statically links FluidSynth against the patched release

Patch Information

The fix is included in FluidSynth Release v2.5.6. The corrective commit bounds the channel index using event->channel % MAX_NUMBER_OF_CHANNELS, ensuring the write and read stay within the allocated array. Additional context is documented in GitHub Security Advisory GHSA-976m-35rw-h3m6.

Workarounds

• Keep synth.midi-channels set to its default value of 16 to avoid the vulnerable code path
• Restrict who can modify FluidSynth configuration files on shared systems
• Remove or disable FluidSynth on hosts where MIDI synthesis is not required

# Verify installed FluidSynth version
fluidsynth --version

# Ensure the default channel count is used when launching
fluidsynth -o synth.midi-channels=16 soundfont.sf2 input.mid