CVE-2026-61714

Name of the Vulnerable Software and Affected Versions FluidSynth (affected versions not specified)

Description A heap-based buffer overflow exists in the MIDI player. When the synthesizer is configured with the synth.midi-channels variable set to a value greater than 16, an out-of-bounds memory access occurs within the fluid player t::channel isplaying array in heap memory, leading to undefined behavior. This issue does not require a specially crafted MIDI file to be triggered.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, ensure that the synth.midi-channels configuration is not set to a value greater than 16.