A critical heap-based buffer overflow vulnerability in FluidSynth version 2.5.5 and earlier allows unauthenticated remote attackers to achieve remote code execution.

The application fails to perform bounds checking on the channel argument within the pitch_bend_range command, leading to a heap-based buffer overflow. This flaw is exploitable by unauthenticated remote attackers when the TCP server functionality is enabled.

The ability for an unauthenticated remote attacker to execute arbitrary code poses a catastrophic risk to system integrity and confidentiality. Successful exploitation could lead to full system compromise, data exfiltration, or prolonged service disruption, justifying the 9.8 CVSS score.

Immediate Action: Update the FluidSynth fluidsynth package to version 2.5.6 or later to incorporate the necessary bounds checking logic.

Proactive Monitoring: Monitor network traffic for unusual activity directed at FluidSynth TCP ports, and review application logs for malformed or unexpected command inputs.

Compensating Controls: If an immediate update is not feasible, disable the FluidSynth TCP server functionality (new_fluid_server or fluidsynth -s) to mitigate remote attack vectors.

Public Exploit Available: Unknown

Given the critical severity and the potential for remote code execution, organizations utilizing FluidSynth must prioritize patching to version 2.5.6 immediately. If the software is deployed in a networked environment with the TCP server enabled, the risk is elevated and requires urgent administrative intervention to prevent unauthorized access or system failure.