USN-8885-1: FluidSynth vulnerabilities

It was discovered that FluidSynth did not properly validate the channel argument of the pitch_bend_range command. A remote attacker could possibly use this issue to cause FluidSynth to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-58264) It was discovered that FluidSynth incorrectly handled configurations with more than 16 MIDI channels in its MIDI player, leading to a heap buffer overflow.