Bug 2538409 (CVE-2026-58264)

Summary: CVE-2026-58264 fluidsynth: FluidSynth: Heap-based buffer overrun
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gtanzill, jbuscemi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FluidSynth. The pitch_bend_range command handler does not check that the channel argument is inside the synthesizer channel array before writing the supplied value, which is an out-of-bounds heap write. An attacker who can send commands to the FluidSynth shell can crash the process and could execute code. Remote attacks require the TCP server, which is disabled unless the application calls new_fluid_server() or the user starts fluidsynth with -s. Local attacks require malicious commands on standard input. Applications that do not use the shell, the command handler, or the TCP server are not affected.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547753    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-22 18:29:25 UTC 
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.