FluidSynth vulnerabilities
We track 5 vulnerabilities in FluidSynth products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest FluidSynth vulnerabilities
- 8.0 High severity
fluidsynth: Heap-based Buffer Overflow
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_s
- 7.8 High severity
fluidsynth: Heap-based Buffer Overflow
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while track
- 9.8 Critical severity
fluidsynth: Heap-based Buffer Overflow
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through th
- 7.5 High severity
Fluidsynth: NULL Pointer Dereference
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
- 7.0 High severity
fluidsynth: Use After Free
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a