FluidSynth’s DLS parser uses an unsigned arithmetic expression cues * 4 + cbsize without checking 32‑bit boundaries. A large cues value can wrap around, causing the parser to request around four gigabytes of memory and read billions of bytes beyond the chunk boundary. This excessive allocation and invalid reads lead to a crash, denying service to the application or any component that uses the synthesizer.

FluidSynth versions 2.5.0 through 2.5.6 that are built with the native DLS parser enabled are affected. Compilations that disable the enable‑native‑dls option are not vulnerable. The flaw appears only when the application processes external DLS files using the existing parsing path.

The CVSS score of 6.8 indicates a moderate severity. No EPSS score is provided, and the flaw is not listed in the CISA KEV catalog. An attacker or user would need to provide a crafted DLS file and trigger the parser. The CVE description does not specify whether the vulnerability is exploitable from a remote context, so the attack vector is not concretely defined. Successful exploitation results in a denial of service due to the parser crash.