A heap-based buffer overflow vulnerability in FluidSynth version 2.2.4 through 2.5.5 permits out-of-bounds memory access, posing a severe risk to system integrity and confidentiality.

The software suffers from heap-based buffer overflow, out-of-bounds read, and out-of-bounds write conditions triggered when the synth.midi-channels configuration exceeds 16. This flaw allows an unauthenticated user or local process to cause undefined behavior that may result in arbitrary code execution or service disruption.

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk. Successful exploitation could lead to unauthorized data access, the modification of critical system files, or a complete denial of service for the synthesizer application, potentially disrupting production workflows that rely on this software.

Immediate Action: Update the FluidSynth software to version 2.5.6 or later to resolve the heap allocation vulnerability.

Proactive Monitoring: Monitor system logs for unexpected application crashes or memory access violations that may indicate exploitation attempts.

Compensating Controls: If an immediate update is not feasible, ensure the synth.midi-channels configuration is strictly set to its default value of 16 to avoid the vulnerable code path.

Public Exploit Available: No

Given the severity of potential memory corruption, organizations utilizing FluidSynth should prioritize upgrading to version 2.5.6. Implementing the recommended configuration restriction to 16 channels serves as a critical immediate mitigation for environments unable to perform an immediate software update.