CVE-2026-61721

LOWCVSS 8.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering, undefined behavior, possible memory disclosure, and denial of service. Builds compiled with the CMake option enable-native-dls set to OFF do not expose the affected parser. This issue is fixed in version 2.5.6.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-122CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-61721

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters1d
CVE-2026-61721 FluidSynth out-of-bounds read via crafted DLS file, up to memory disclosure and DoS. CVSS 8. Fixed in 2.5.6, update now. https://www.valtersit.com/cve/CVE-2026-61721 #CVE #infosec #FluidSynth #FluidSynth #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
0000028
1.1K followersView on X

Explore more

Back to dashboard