Detections
Analytics

Echo: fluidsynth: security update to 2.4.4+dfsg-1+deb13u2+e1

critical Tenable Cloud Security Plugin ID 461007

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the
 FluidSynth command handler accepts a pitch_bend_range command whose channel argument is not bounds checked
 before the supplied value is written through the selected synth channel. An out-of-range channel can
 therefore cause an out-of-bounds heap write, leading to denial of service or possible code execution. The
 issue is remotely reachable when the TCP server is enabled through new_fluid_server() or fluidsynth -s,
 and it is locally reachable through malicious commands delivered to the FluidSynth shell on standard
 input. Applications that do not use the shell, command handler, or TCP server are not affected. This issue
 is fixed in version 2.5.6. (CVE-2026-58264)

Solution

Update the fluidsynth library and its related packages to version 2.4.4+dfsg-1+deb13u2+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-58264

Plugin Details

Severity: Critical

ID: 461007

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.36

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-58264

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/24/2026

Vulnerability Publication Date: 7/16/2026

Reference Information

CVE: CVE-2026-58264

IAVB: 2026-B-0192