CVE-2026-61720

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/FluidSynth/fluidsynth/commit/096e1ff0d09ddcac83d94923440706f76f94bc44
https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6
https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-rmc4-c8hw-455w

Configurations

No configuration.

History

18 Sep 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-18 20:17

Updated : 2026-09-24 21:25

NVD link : CVE-2026-61720

Mitre link : CVE-2026-61720

CVE.ORG link : CVE-2026-61720

JSON object : View

Products Affected

No product.

CWE

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2026-61720", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61720", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T16:27:05.665077Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FluidSynth", "product": "fluidsynth", "versions": [{"status": "affected", "version": ">= 2.5.0, < 2.5.6"}]}]}], "published": "2026-09-18T20:17:18.420", "references": [{"url": "https://github.com/FluidSynth/fluidsynth/commit/096e1ff0d09ddcac83d94923440706f76f94bc44", "source": "security-advisories@github.com"}, {"url": "https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-rmc4-c8hw-455w", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6."}], "lastModified": "2026-09-24T21:25:27.050", "sourceIdentifier": "security-advisories@github.com"}