{"schema":"threatline.record/2","record":{"id":"CVE-2026-111123","aliases":[],"summary":"FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination","details":"FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.","categories":["Unclassified"],"product":"fluidsynth","vendor":"FluidSynth","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111123","source_modified_at":"2026-10-15T19:46:31.057Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"fluidsynth","vendor":"FluidSynth","versions":[{"version":"0","lessThanOrEqual":"2.6.1","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00198,"percentile":0.09066,"score_date":"2026-10-23"},"published_at":"2026-10-15T18:57:20.663Z","modified_at":"2026-10-15T19:46:31.057Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111123","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T19:46:31.057Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111123","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind-pwn/fluidsynth-sf2-modulator-dest-generator-oob-write","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/synth/fluid_voice.c#L615-L623","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/synth/fluid_voice.c#L1184-L1229","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/sfloader/fluid_defsfont.c#L1609-L1611","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/FluidSynth/fluidsynth","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/fluidsynth-through-2.6.1-out-of-bounds-write-via-soundfont-modulator-destination","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T19:46:04.553463Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T19:46:31.057Z","content_hash":"c35e9d95de4b82a7c0472f5945a47038370c19246a9ddb698cf566aba07093b3"}}