Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61722— FluidSynth: DLS Articulation Chunk Integer Overflow

Quick assessment

Affected
FluidSynth fluidsynth
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FluidSynth 是一款基于 SoundFont 2 规范的软件合成器。在 2.5.0 至 2.5.6 版本中，其原生 DLS 解析器在验证 articulation 块时，使用无符号表达式 来计算预期大小，但未先确保该乘法和加法运算的结果能容纳在 32 位内。攻击者可通过构造特殊的 DLS 文件，提供一个极大的 值，使得表达式结果发生无符号溢出（环绕），从而绕过块大小检查；随后，解析器会在块边界外执行约十亿次 12 字节的迭代处理。这种过度的计算和越界读取可能导致服务拒绝（Denial of Service）

CVSS 6.8 · Medium

Possible ATT&CK Techniques 1 AI

T1029 · Scheduled Transfer
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61722

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FluidSynth: DLS Articulation Chunk Integer Overflow
Source: CVE Program / CVE List V5
Vulnerability Description
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks * 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large connblocks value that wraps the expression and bypasses the chunk-size check, after which the parser performs approximately one billion 12-byte iterations beyond the chunk boundary. The excessive processing and invalid reads can cause denial of service. Builds with the CMake option enable-native-dls set to OFF do not expose the parser. This issue is fixed in version 2.5.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FluidSynth fluidsynth >= 2.5.0, < 2.5.6 -

II. Public POCs for CVE-2026-61722

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61722

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61722 (1)

Other References for CVE-2026-61722 (2)

Same Patch Batch · FluidSynth · 2026-09-18 · 6 CVEs total

CVE-2026-58264 9.8 CRITICAL FluidSynth: Heap-based buffer overrun
CVE-2026-61721 8.0 HIGH FluidSynth: Heap-based buffer overrun for DLS samples
CVE-2026-61714 7.8 HIGH FluidSynth: Heap Buffer Overflow in MIDI Player
CVE-2026-61723 6.8 MEDIUM FluidSynth: DLS ptbl Chunk Integer Overflow
CVE-2026-61720 6.2 MEDIUM FluidSynth: SF2 DMOD Chunk Unsigned Underflow

IV. Related Vulnerabilities

Same product: fluidsynth
Same vendor: FluidSynth
Same weakness: CWE-190

V. Comments for CVE-2026-61722

No comments yet

Leave a comment