It was discovered that FluidSynth did not properly validate the channel argument of the pitch_bend_range command. A remote attacker could possibly use this issue to cause FluidSynth to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-58264) It was discovered that FluidSynth incorrectly handled configurations with more than 16 MIDI channels in its MIDI player, leading to a heap buffer overflow.
USN-8885-1: FluidSynth vulnerabilities
About this summary. This is a short excerpt from the description that Ubuntu Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://ubuntu.com/security/notices/USN-8885-1
Source attribution: headline and facts are from Ubuntu Security (ubuntu.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
USN-8957-1: authd vulnerability
Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to…
Backporting security fixes to stable releases
The software you are running is almost certainly riddled with known, unfixed security bugs. These bugs can be trivially and quickly exploited by modern AI agents. This…
USN-8956-1: Brotli vulnerability
It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute…
USN-8955-1: nginx vulnerabilities
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this…
USN-8954-1: zlib vulnerability
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow…
USN-8953-1: OpenVPN vulnerability
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.