Medium
Security advisory
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-21417
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:42 UTC · Revision 1
Source evidence
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.
osv:CVE-2021-21417
Complete source record
{
"id": "26c5c057b83aaca04d7d593aa629e512f691551fc4bf96af7e9bc387aa1b3b82",
"url": "https://osv.dev/vulnerability/CVE-2021-21417",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-21417",
"summary": "fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.",
"evidence": "osv:CVE-2021-21417",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-21417",
"aliases": [
"CVE-2021-21417",
"GHSA-6fcq-pxhc-jxc9"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/fluidsynth/fluidsynth",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "005719628aef0bd48dc7b2f860c7e4ca16b81044"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:fluidsynth:fluidsynth:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.1.8"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2.1.7",
"v2.1.6",
"v2.1.5",
"v2.1.4",
"v2.1.3",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.1.0.rc1",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v2.0.0.rc1",
"v2.0.0.beta2",
"v2.0.0.beta1",
"v1.1.6",
"v1.1.5",
"v1.1.4",
"v1.1.3",
"v1.1.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21417.json",
"vanir_signatures": [
{
"id": "CVE-2021-21417-b2340688",
"digest": {
"threshold": 0.9,
"line_hashes": [
"48885938282331019127197626419836307014",
"110753109995881962928445110041674456256",
"121492536121844320821012634259806870192",
"244250008653137373573258873778707470889",
"110481844234258377108205728634290871755",
"106434345867872264672328437380783120138",
"75442270675680468273110843789053691131",
"95798495319292279337806353917834424064",
"333074141710635353878506192750459148821",
"47326553705705572167105152637548941869",
"16808106559652375976008750122874879042",
"172764031837794924691065524078847990979",
"220534147200632390022598891401921673442",
"13850095192963669915694205988520717420",
"236778933972772207078581007412662589462",
"318383126056721000529860358731732644709",
"85476600705861003317693399597125986122",
"288936857336585327545519535369585347744",
"121492536121844320821012634259806870192",
"244250008653137373573258873778707470889",
"336122938356400900669879383199080583791",
"322868890313760197567011974418590242518",
"42515258426239574087291571328387395543",
"329887052572185232004397664573681896528",
"333074141710635353878506192750459148821",
"160110383922649587958162413498630141605",
"285706012640618526127375349468795119952",
"275649253706964016154533079856786817649",
"101735777680155907571942409117773240958",
"11104868105589290390572019506936048960",
"236778933972772207078581007412662589462",
"318383126056721000529860358731732644709"
]
},
"source": "https://github.com/fluidsynth/fluidsynth/commit/005719628aef0bd48dc7b2f860c7e4ca16b81044",
"target": {
"file": "src/sfloader/fluid_sffile.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-21417-cfdb3ac4",
"digest": {
"length": 2846,
"function_hash": "331369067606282572002129312609689129378"
},
"source": "https://github.com/fluidsynth/fluidsynth/commit/005719628aef0bd48dc7b2f860c7e4ca16b81044",
"target": {
"file": "src/sfloader/fluid_sffile.c",
"function": "load_pgen"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-21417-e6733bbb",
"digest": {
"length": 2834,
"function_hash": "95500749034621577397607449282478807781"
},
"source": "https://github.com/fluidsynth/fluidsynth/commit/005719628aef0bd48dc7b2f860c7e4ca16b81044",
"target": {
"file": "src/sfloader/fluid_sffile.c",
"function": "load_igen"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:14:51Z"
}
}
],
"modified": "2026-10-20T14:14:51.929837944Z",
"provider": "osv",
"references": [
"https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9",
"https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html",
"https://github.com/FluidSynth/fluidsynth/pull/810",
"https://github.com/FluidSynth/fluidsynth/issues/808"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-21417",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388762,
"published_at": "2021-04-29T17:15:09.023+00:00"
}