FluidSynth Heap/Stack Corruption via Invalid SoundFont Modulator

Executive Summary

CVE-2026-111123 is an out-of-bounds write vulnerability in FluidSynth through version 2.6.1. It occurs when SoundFont modulator destination values are not properly validated. Attackers can craft an SF2 file with PMOD/IMOD destinations set to 63-255, causing the program to write past the voice generator array and updated_gen_bit. This leads to memory corruption and crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or memory corruption when loading SoundFont files in FluidSynth. Check logs for segmentation faults or heap corruption errors during note-on events or control changes. Use tools like AddressSanitizer (ASan) or Valgrind to detect out-of-bounds writes when processing SF2 files with FluidSynth.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to corrupt heap and stack memory by supplying malicious SoundFont files. This may result in crashes, denial-of-service conditions, or potentially arbitrary code execution. Users loading untrusted SoundFont files are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes memory corruption and crashes by exploiting out-of-bounds writes in FluidSynth's SoundFont modulator handling. It does not directly impact GDPR or HIPAA compliance unless the affected software processes or stores personal or health data. However, if FluidSynth is used in systems handling such data, crashes or memory corruption could lead to data loss or unauthorized access, indirectly affecting compliance.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade FluidSynth to the latest patched version if available.
• Avoid loading untrusted SoundFont files, especially those with PMOD/IMOD destinations set to values between 63 and 255.
• Implement input validation for SoundFont files before processing them with FluidSynth.

Useful 0 Not Useful 0