CVE-2026-61714
Description
A flaw was found in FluidSynth, a software synthesizer. When the synth.midi-channels configuration is set above 16, the MIDI player can write beyond the allocated memory for tracking active channels. This heap buffer overflow can lead to out-of-bounds memory access, potentially compromising the confidentiality, integrity, or availability of the system. This vulnerability is triggered by the configuration itself and does not require a specially crafted MIDI file.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this vulnerability, ensure that the `synth.midi-channels` configuration in FluidSynth is set to its default value of 16 or lower. This can be achieved by editing the FluidSynth configuration file (e.g., `~/.fluidsynth` or a system-wide configuration file) to explicitly set `synth.midi-channels` to 16 or by removing any configuration that sets it to a higher value. Changes to the configuration will take effect the next time FluidSynth is initialized or restarted.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
