FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-range channel can therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s, and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue is fixed in version 2.5.6.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8885-1 advisory.

    It was discovered that FluidSynth did not properly validate the channel argument of the pitch_bend_range     command. A remote attacker could possibly use this issue to cause FluidSynth to crash, resulting in a     denial of service, or execute arbitrary code. (CVE-2026-58264)

    It was discovered that FluidSynth incorrectly handled configurations with more than 16 MIDI channels in     its MIDI player, leading to a heap buffer overflow. An attacker could possibly use this issue to cause     FluidSynth to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61714)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the
    FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked
    before the supplied value is written through the selected synth channel. An out-of-range channel can
    therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The
    issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s,
    and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard
    input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue
    is fixed in version 2.5.6. (CVE-2026-58264)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the     FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked     before the supplied value is written through the selected synth channel. An out-of-range channel can     therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The     issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s,     and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard     input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue     is fixed in version 2.5.6. (CVE-2026-58264)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363808	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : FluidSynth vulnerabilities (USN-8885-1)	Nessus	Ubuntu Local Security Checks	Local	critical
461007	Echo: fluidsynth: security update to 2.4.4+dfsg-1+deb13u2+e1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
461007	Echo: fluidsynth: security update to 2.4.4+dfsg-1+deb13u2+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
329667	Linux Distros Unpatched Vulnerability : CVE-2026-58264	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-58264

critical

Tenable Plugins

critical

critical

critical

critical