rootpwn

high · CVSS v3 6.2

CVE-2026-61720

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser com…

Description

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations. This exhausts process memory and causes denial of service. No workaround is available. This issue is fixed in version 2.5.6.

Scores

Severity
high
CVSS v2
7.5
CVSS v3
6.2
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-93854

OpenStack Blazar's lease API fails to enforce object-level authorization on update/delete, allowing authenticated users to modify or delete leases of other projects if they know the lease ID. This bypasses intended ownership checks and can lead to unauthorized data tampering.

View analysis

high

CVE-2017-20284

Caucho Resin's documentation webapp (resin-doc) has a path traversal flaw that lets unauthenticated users read arbitrary files via the inputFile parameter. The vulnerability can be exploited remotely without authentication. It was publicly reported in 2021 by Shadowserver.

View analysis