Notice USN-8885-1: validation flaws and buffer overflow in FluidSynth

Notice USN-8885-1, published on 6 October 2026 in the Ubuntu Security feed, covers validation flaws and a buffer overflow in FluidSynth, a software synthesizer that plays MIDI files and events. According to the text, the first flaw (CVE-2026-58264) occurs because FluidSynth did not properly validate the channel argument of the pitch_bend_range command. A remote attacker could possibly exploit it to crash the program, causing denial of service, or to execute arbitrary code. The second flaw (CVE-2026-61714) occurs because FluidSynth mishandled configurations with more than 16 MIDI channels in its MIDI player, leading to a heap buffer overflow with the same possible consequences. According to the notice, this second issue affected only Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The original content is an automatic translation of the notice. To consult the official version, find the identifier USN-8885-1 on the Ubuntu security notices page and check the fixed package versions listed for each release. To verify whether your installation is exposed, check the installed FluidSynth version and compare it with the fixes listed in the official notice.