CVE-2026-58264 Details

A heap-based buffer overrun vulnerability has been identified in FluidSynth versions 1.1.2 prior to 2.5.6. The issue arises in the command handler, where the pitch_bend_range command's channel argument is not properly bounds-checked. This lack of validation allows an out-of-range channel to cause an out-of-bounds heap write, which could lead to a denial-of-service condition or potentially allow for code execution. The vulnerability can be exploited remotely when the TCP server is enabled, or locally through malicious commands sent to the FluidSynth shell via standard input. Applications that do not utilize the shell, command handler, or TCP server are not affected.

Users are advised to update FluidSynth to version 2.5.6 or later. If the TCP server is not needed, it should be disabled to reduce the risk, although the vulnerability could still be exploited through the local shell.