{"id":"USN-8885-1","summary":"fluidsynth vulnerabilities","details":"It was discovered that FluidSynth did not properly validate the channel\nargument of the pitch_bend_range command. A remote attacker could\npossibly use this issue to cause FluidSynth to crash, resulting in a\ndenial of service, or execute arbitrary code. (CVE-2026-58264)\n\nIt was discovered that FluidSynth incorrectly handled configurations with\nmore than 16 MIDI channels in its MIDI player, leading to a heap buffer\noverflow. An attacker could possibly use this issue to cause FluidSynth\nto crash, resulting in a denial of service, or execute arbitrary code.\nThis issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu\n26.04 LTS. (CVE-2026-61714)","modified":"2026-10-06T23:42:35.082330049Z","published":"2026-10-06T15:45:33Z","related":["UBUNTU-CVE-2026-58264","UBUNTU-CVE-2026-61714"],"upstream":["CVE-2026-58264","CVE-2026-61714","UBUNTU-CVE-2026-58264","UBUNTU-CVE-2026-61714"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8885-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-58264"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-61714"}],"affected":[{"package":{"name":"fluidsynth","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/fluidsynth?arch=source&distro=esm-infra-legacy%2Ftrusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-2ubuntu0.1~esm1"}]}],"versions":["1.1.6-2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.1.6-2ubuntu0.1~esm1","binary_name":"fluidsynth"},{"binary_version":"1.1.6-2ubuntu0.1~esm1","binary_name":"libfluidsynth1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:14.04:LTS","cves":[{"id":"CVE-2026-58264","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8885-1.json"}},{"package":{"name":"fluidsynth","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/fluidsynth?arch=source&distro=esm-apps-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-3ubuntu0.1~esm1"}]}],"versions":["1.1.6-2build1","1.1.6-3"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro","binaries":[{"binary_name":"fluidsynth","binary_version":"1.1.6-3ubuntu0.1~esm1"},{"binary_version":"1.1.6-3ubuntu0.1~esm1","binary_name":"libfluidsynth1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:16.04:LTS","cves":[{"id":"CVE-2026-58264","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8885-1.json"}},{"package":{"name":"fluidsynth","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/fluidsynth?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9-1ubuntu0.1~esm1"}]}],"versions":["1.1.6-4","1.1.8-1","1.1.8-2","1.1.8-3","1.1.9-1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_version":"1.1.9-1ubuntu0.1~esm1","binary_name":"fluidsynth"},{"binary_name":"libfluidsynth1","binary_version":"1.1.9-1ubuntu0.1~esm1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-58264"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8885-1.json"}},{"package":{"name":"fluidsynth","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/fluidsynth?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-2ubuntu0.1~esm1"}]}],"versions":["1.1.11-4","1.1.11-4ubuntu1","2.1.0-1","2.1.1-2"],"ecosystem_specific":{"binaries":[{"binary_name":"fluidsynth","binary_version":"2.1.1-2ubuntu0.1~esm1"},{"binary_name":"libfluidsynth2","binary_version":"2.1.1-2ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[{"id":"CVE-2026-58264","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8885-1.json"}},{"package":{"name":"fluidsynth","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/fluidsynth?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-1ubuntu0.1~esm1"}]}],"versions":["2.1.7-1.1","2.2.4-2","2.2.5-1"],"ecosystem_specific":{"binaries":[{"binary_name":"fluidsynth","binary_version":"2.2.5-1ubuntu0.1~esm1"},{"binary_name":"libfluidsynth3","binary_version":"2.2.5-1ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:22.04:LTS","cves":[{"id":"CVE-2026-58264","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-61714","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8885-1.json"}},{"package":{"name":"fluidsynth","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/fluidsynth?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-1ubuntu0.1~esm1"}]}],"versions":["2.3.3-2.1","2.3.4-1","2.3.4-1build1","2.3.4-1build2","2.3.4-1build3"],"ecosystem_specific":{"binaries":[{"binary_version":"2.3.4-1ubuntu0.1~esm1","binary_name":"fluidsynth"},{"binary_version":"2.3.4-1ubuntu0.1~esm1","binary_name":"libfluidsynth3"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:24.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-58264"},{"id":"CVE-2026-61714","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8885-1.json"}},{"package":{"name":"fluidsynth","ecosystem":"Ubuntu:Pro:26.04:LTS","purl":"pkg:deb/ubuntu/fluidsynth?arch=source&distro=esm-apps%2Fresolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8+dfsg-1ubuntu0.1~esm1"}]}],"versions":["2.4.7+dfsg-2","2.4.8+dfsg-1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"fluidsynth","binary_version":"2.4.8+dfsg-1ubuntu0.1~esm1"},{"binary_name":"libfluidsynth3","binary_version":"2.4.8+dfsg-1ubuntu0.1~esm1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:26.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-58264"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-61714"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8885-1.json"}}],"schema_version":"1.9.0"}