Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-61720

FluidSynth: SF2 DMOD Chunk Unsigned Underflow

CVSS 3.1 6.2 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-61720

Published

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.

Read the publisher's advisory

Affected versions, risk and source history

Related advisories and sources

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-61720 · CVE overview and exploitation status

cve-program · CVE-2026-61720

Related changes

Linked by CVE identifier

No related changes are available here.