Synopsis:
fluidsynth security updateSummary:
An update for fluidsynth is now available for openEuler-22.03-LTS-SP4Description:
FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.
Security Fix(es):
A heap-based buffer overflow was discovered in fluidsynth's MIDI player. When the synth is configured with synth.midi-channels > 16 an out-of-bounds memory access is performed on the array _fluid_player_t::channel_isplaying in heap memory invoking undefined behavior. No crafted MIDI file is required to expose this vulnerability.(CVE-2026-61714)Topic:
An update for fluidsynth is now available for openEuler-22.03-LTS-SP4.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.Severity:
HighAffected Component:
fluidsynth
2.2.7-4.oe2203sp42.2.7-4.oe2203sp42.2.7-4.oe2203sp42.2.7-4.oe2203sp42.2.7-4.oe2203sp4Exploitability
AV:LAC:LPR:NUI:RScope
S:UImpact
C:HI:HA:H7.8/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H