CVE-2026-61721

Name of the Vulnerable Software and Affected Versions FluidSynth versions 2.5.0 through 2.5.5

Description The native DLS loader fails to call fluid sample validate() or fluid sample sanitize loop() when assigning wsmp.loop start and wsmp.loop length values to samples. A specially crafted DLS file can set sample loop points outside the sample buffer, leading to out-of-bounds reads during audio rendering. This can result in undefined behavior, memory disclosure, or denial of service. This issue only affects builds where the CMake option enable-native-dls is set to ON.

Recommendations Update to version 2.5.6. As a temporary mitigation, compile the software with the CMake option enable-native-dls set to OFF to disable the affected parser.