FluidSynth through version 2.6.1 contains an out‑of‑bounds write that can corrupt heap and stack memory when a malicious SoundFont file supplies modulator destination values beyond the allowed range. The over‑range values overwrite data past the voice generator array and the updated_gen_bit field, leading to memory corruption and application crashes. No mention of arbitrary code execution is given, but the memory corruption potentially could be exploited to break program integrity.

The flaw affects all FluidSynth deliveries up to and including 2.6.1. The affected product is FluidSynth distributed under the FluidSynth open‑source project. Device or server setups that use this library and load third‑party SF2 files are susceptible as long as the library version remains unchanged.

The CVSS score of 6.9 reflects a moderate severity; the EPSS indicates a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to supply a crafted SoundFont file to the application that links to FluidSynth, which is feasible for local users or remote users whose activity triggers the file loading. The failure mode is memory corruption, which can lead to crashes or more severe compromise if the corruption is leveraged.