Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-61720

FluidSynth: SF2 DMOD Chunk Unsigned Underflow

CVSS 3.1 6.2 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-61720

Published

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-61720

Published

fluidsynth

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "FluidSynth",
                    "product": "fluidsynth",
                    "versions": [
                        {
                            "version": ">= 2.5.0, < 2.5.6",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON