FluidSynth versions 2.5.0 through 2.5.5 are vulnerable to memory corruption and denial of service via maliciously crafted DLS files.

The vulnerability arises because the native DLS loader fails to validate or sanitize loop start and length values, allowing an attacker to trigger out-of-bounds reads during audio rendering. This flaw can be triggered by an unauthenticated attacker providing a crafted DLS file to the software.

Successful exploitation of this vulnerability allows for potential memory disclosure or a denial of service condition, which could crash the application or expose sensitive process data. With a CVSS score of 8.0, the risk is categorized as High, necessitating prompt attention to ensure application stability and the integrity of the host environment.

Immediate Action: Upgrade to FluidSynth version 2.5.6 or later, which includes the necessary validation logic to prevent out-of-bounds memory access.

Proactive Monitoring: Monitor system logs for unexpected application crashes or segmentation faults that may indicate attempts to trigger the buffer overflow.

Compensating Controls: If upgrading is not immediately feasible, ensure that FluidSynth is compiled with the CMake option enable-native-dls set to OFF to disable the vulnerable parser.

Public Exploit Available: Unknown

Given the High severity rating, organizations utilizing FluidSynth should prioritize updating to version 2.5.6. If the native DLS loader is not required for your specific operational use case, disabling it via build configuration provides an effective stopgap measure to neutralize this attack vector immediately.