Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61723— FluidSynth: DLS ptbl Chunk Integer Overflow

Quick assessment

Affected
FluidSynth fluidsynth
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FluidSynth 是一款基于 SoundFont 2 规范的软件合成器。在 2.5.0 到 2.5.6 版本中，其原生 DLS 解析器在校验 块时，使用无符号表达式 而未检查乘法和加法的结果是否能在 32 位整数范围内表示。精心构造的 DLS 文件可以提供一个非常大的 值，使得乘法结果发生回绕（wrap-around），从而通过块大小检查，导致 请求分配约 4GB 内存，并让解析器读取远超块边界的数十亿个条目。这种过度的内存分配和非法读取可能导致拒绝服务（DoS）漏洞。将构建选项 设置为 OFF 的版本不受此问

CVSS 6.8 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61723

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FluidSynth: DLS ptbl Chunk Integer Overflow
Source: CVE Program / CVE List V5
Vulnerability Description
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues * 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a large cues value that wraps the expression and passes the chunk-size check, causing poolcues.resize(cues) to request approximately four gigabytes and the parser to read billions of entries beyond the chunk boundary. The excessive allocation and invalid reads can cause denial of service. Builds with enable-native-dls set to OFF are not exposed. This issue is fixed in version 2.5.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FluidSynth fluidsynth >= 2.5.0, < 2.5.6 -

II. Public POCs for CVE-2026-61723

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61723

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61723 (1)

Other References for CVE-2026-61723 (2)

Same Patch Batch · FluidSynth · 2026-09-18 · 6 CVEs total

CVE-2026-58264 9.8 CRITICAL FluidSynth: Heap-based buffer overrun
CVE-2026-61721 8.0 HIGH FluidSynth: Heap-based buffer overrun for DLS samples
CVE-2026-61714 7.8 HIGH FluidSynth: Heap Buffer Overflow in MIDI Player
CVE-2026-61722 6.8 MEDIUM FluidSynth: DLS Articulation Chunk Integer Overflow
CVE-2026-61720 6.2 MEDIUM FluidSynth: SF2 DMOD Chunk Unsigned Underflow

IV. Related Vulnerabilities

Same product: fluidsynth
Same vendor: FluidSynth
Same weakness: CWE-190

V. Comments for CVE-2026-61723

No comments yet

Leave a comment