USN-8885-1

It was discovered that FluidSynth did not properly validate the channel argument of the pitch_bend_range command. A remote attacker could possibly use this issue to cause FluidSynth to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-58264) It was discovered that FluidSynth incorrectly handled configurations with more than 16 MIDI channels in its MIDI player, leading to a heap buffer overflow. An attacker could possibly use this issue to cause FluidSynth to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61714) Update Instructions: Run `sudo pro fix USN-8885-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: fluidsynth - 2.4.8+dfsg-1ubuntu0.1~esm1 libfluidsynth3 - 2.4.8+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro: https://ubuntu.com/pro

Upstream Advisory

• View official advisory

Affected Packages

• fluidsynth 2.4.8+dfsg-1ubuntu0.1~esm1-2.4.8+dfsg-1ubuntu0.1~esm1

• libfluidsynth3 2.4.8+dfsg-1ubuntu0.1~esm1-2.4.8+dfsg-1ubuntu0.1~esm1

• fluidsynth 2.2.5-1ubuntu0.1~esm1-2.2.5-1ubuntu0.1~esm1

• libfluidsynth3 2.2.5-1ubuntu0.1~esm1-2.2.5-1ubuntu0.1~esm1

• fluidsynth 2.3.4-1ubuntu0.1~esm1-2.3.4-1ubuntu0.1~esm1

• libfluidsynth3 2.3.4-1ubuntu0.1~esm1-2.3.4-1ubuntu0.1~esm1

• fluidsynth 2.1.1-2ubuntu0.1~esm1-2.1.1-2ubuntu0.1~esm1

• libfluidsynth2 2.1.1-2ubuntu0.1~esm1-2.1.1-2ubuntu0.1~esm1