CVE-2026-61722 FluidSynth 2.5.0-2.5.6: crafted DLS file triggers integer overflow in the native parser, bypassing chunk-size checks and causing a denial of service through massive out-of-bounds iterations. CVSS 6.8. Patch to https://www.valtersit.com/cve/CVE-2026-61722/ #CVE #infosec #FluidSynth

CVE-2026-61720 FluidSynth SF2 parser DoS: zero-sized DMOD chunk wraps count to UINT_MAX, triggering billions of allocations and memory exhaustion. CVSS 6.2. Patched in 2.5.6, no workaround. Update now. https://www.valtersit.com/cve/CVE-2026-61720/ #CVE #infosec #FluidSynth

CVE-2026-61714 FluidSynth out-of-bounds read/write via synth.midi-channels above 16, CVSS 7.8. Versions 2.2.4 to 2.5.6 affected. Patch now: https://www.valtersit.com/cve/CVE-2026-61714/ #CVE #infosec #FluidSynth

CVE-2026-58264 - fluidsynth
Versions of FluidSynth from 1.1.2 up to 2.5.6 let a specially crafted pitch‑bend range command write data outside the program’s memory. This can make the program stop…

Too many irrelevant or confusing CVEs? Use stackflag.com

#fluidsynth #debian #Debian11 #CVE #infosec