USN-8885-1: two FluidSynth flaws fixed via Ubuntu Pro ESM Apps
Ubuntu has flagged two vulnerabilities in FluidSynth that can cause crashes or arbitrary code execution. A patch is available via Ubuntu Pro ESM Apps.
UptimeMag editorial team · 6 October 2026 · 2 min read
On 6 October 2026, Ubuntu published security notice USN-8885-1 for FluidSynth, the real-time MIDI software synthesiser. It affects anyone with the fluidsynth or libfluidsynth package installed on Ubuntu systems, including servers where it arrives as a dependency of audio toolchains or applications that process MIDI files.
The two flaws
The first, CVE-2026-58264, concerns a missing validation of the "channel" argument in the pitch_bend_range command. A remote attacker could exploit it to crash FluidSynth (denial of service) or, potentially, execute arbitrary code. It affects all supported releases, from Ubuntu 14.04 LTS through to 26.04 LTS.
The second, CVE-2026-61714, is a heap buffer overflow triggered when FluidSynth's MIDI player handles configurations with more than 16 MIDI channels. Again, the risk is a crash or code execution. This vulnerability only affects Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS.
Fixed versions
According to the official Ubuntu advisory, the patched versions are:
| Release | Package | Fixed version |
|---|---|---|
| 26.04 LTS | fluidsynth / libfluidsynth3 | 2.4.8+dfsg-1ubuntu0.1~esm1 |
| 24.04 LTS | fluidsynth / libfluidsynth3 | 2.3.4-1ubuntu0.1~esm1 |
| 22.04 LTS | fluidsynth / libfluidsynth3 | 2.2.5-1ubuntu0.1~esm1 |
| 20.04 LTS | fluidsynth / libfluidsynth2 | 2.1.1-2ubuntu0.1~esm1 |
| 18.04 LTS | fluidsynth / libfluidsynth1 | 1.1.9-1ubuntu0.1~esm1 |
| 16.04 LTS | fluidsynth / libfluidsynth1 | 1.1.6-3ubuntu0.1~esm1 |
| 14.04 LTS | fluidsynth / libfluidsynth1 | 1.1.6-2ubuntu0.1~esm1 |
For all releases from 18.04 to 26.04 LTS, the fix is delivered via Ubuntu Pro via ESM Apps; for 14.04 LTS, the Legacy Support add-on is required. The advisory states that "a community fix might become publicly available in the future", so at present there is no equivalent package outside Ubuntu Pro for the more recent releases.
What to do
On systems with Ubuntu Pro enabled, a standard update (apt update && apt upgrade) applies the patches. Ubuntu Pro is free for up to 5 machines and covers over 25,000 packages in Main and Universe with a decade of support. Full details and instructions are available in the official advisory at ubuntu.com/security/notices/USN-8885-1.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50). Source: Ubuntu – avvisi di sicurezza.