CVE-2026-111123— FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination
Quick assessment
Affected
FluidSynth fluidsynth
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 FluidSynth 2.6.1 及更早版本中存在一个越界写入漏洞，攻击者可以通过提供未经验证的 SoundFont 调制器目标值来破坏堆和栈内存。攻击者可构造一个包含 PMOD/IMOD 目标值介于 63 到 255 之间的 SF2 文件，当该文件被加载并播放时，会导致写入超出语音生成器数组和 updated_gen_bit 的范围，从而引发内存损坏和程序崩溃。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| FluidSynth | fluidsynth | ≤ 2.6.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111123
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination
Source: CVE Program / CVE List V5
Vulnerability Description
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| FluidSynth | fluidsynth | 0 ~ 2.6.1 | - |
|
II. Public POCs for CVE-2026-111123
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111123
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-111123 (1)
Vendor Pages for CVE-2026-111123 (1)
Other References for CVE-2026-111123 (1)
IV. Related Vulnerabilities
Same product: fluidsynth
-
CVE-2026-61720
FluidSynth: SF2 DMOD Chunk Unsigned Underflow -
CVE-2026-61723
FluidSynth: DLS ptbl Chunk Integer Overflow -
CVE-2026-61722
FluidSynth: DLS Articulation Chunk Integer Overflow -
CVE-2026-61714
FluidSynth: Heap Buffer Overflow in MIDI Player -
CVE-2026-61721
FluidSynth: Heap-based buffer overrun for DLS samples
Same vendor: FluidSynth
-
CVE-2026-61720
FluidSynth: SF2 DMOD Chunk Unsigned Underflow -
CVE-2026-61723
FluidSynth: DLS ptbl Chunk Integer Overflow -
CVE-2026-61722
FluidSynth: DLS Articulation Chunk Integer Overflow -
CVE-2026-61714
FluidSynth: Heap Buffer Overflow in MIDI Player -
CVE-2026-61721
FluidSynth: Heap-based buffer overrun for DLS samples
Same weakness: CWE-787
-
CVE-2026-111880
FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTL -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-85746
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nest -
CVE-2026-105958
Spice-server: spice: heap oob read/write via unchecked migra
V. Comments for CVE-2026-111123
No comments yet