Back Linuxsecurity Fedora 43: MuseScore Critical FluidSynth DoS CVE-2025
MuseScore is a free cross platform WYSIWYG music notation program. Some highlights: * WYSIWYG, notes are entered on a "virtual note sheet" * Unlimited number of staves * Up to four voices per staff * Easy and fast note entry with mouse, keyboard or MIDI * Integrated sequencer and FluidSynth software synthesizer * Import and export of MusicXML and Standard MIDI Files (SMF) * Translated in 26 languages Update Information : This update adds a patch to fix CVE-2025-56225, a flaw in the bundled version of fluidsynth.
MuseScore is a free cross platform WYSIWYG music notation program. Some
* WYSIWYG, notes are entered on a "virtual note sheet"
* Unlimited number of staves
* Up to four voices per staff
* Easy and fast note entry with mouse, keyboard or MIDI
* Integrated sequencer and FluidSynth software synthesizer
* Import and export of MusicXML and Standard MIDI Files (SMF)
* Translated in 26 languages
This update adds a patch to fix CVE-2025-56225, a flaw in the bundled version of fluidsynth.
* Fri Jan 9 2026 Jerry James - 4.6.5-32 - Patch for CVE-2025-56225
* Fri Jan 9 2026 Jerry James - 4.6.5-32 - Patch for CVE-2025-56225
[ 1 ] Bug #2428300 - CVE-2025-56225 musescore: FluidSynth: Denial of Service via invalid MIDI file processing [fedora-43]
[ 1 ] Bug #2428300 - CVE-2025-56225 musescore: FluidSynth: Denial of Service via invalid MIDI file processing [fedora-43]
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-afe4be8cb3' at the command line. For more information, refer to the dnf documentation available at
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
