CVE-2025-10256 — NULL Pointer Dereference in Ffmpeg

CWE-476 — NULL Pointer Dereference12 documents8 sources
Severity
5.5MEDIUMNVD
CNA5.3OSV7.5
EPSS
0.0%
top 99.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedFeb 18

Description

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDffmpeg/ffmpeg3.2 — 8.0
▶debiandebian/ffmpeg< ffmpeg 7:4.3.9-0+deb11u2 (bullseye)
▶Debianffmpeg/ffmpeg< 7:4.3.9-0+deb11u2+2
▶Ubuntuffmpeg/ffmpeg< 7:3.4.11-0ubuntu0.1+esm11+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
CVEList
Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)↗2026-02-18
▶
OSV
CVE-2025-10256: A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer↗2026-02-18
▶
GHSA
GHSA-c96q-rf2r-2xj8: A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer↗2026-02-18
▶
OSV
ffmpeg vulnerabilities↗2025-10-21
▶

📋Vendor Advisories

3
Ubuntu
FFmpeg vulnerabilities↗2025-10-21
▶
Debian
CVE-2025-10256: ffmpeg - A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter ...↗2025
▶
Red Hat
ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)↗2024-08-07
▶

🕵️Threat Intelligence

4
Wiz
CVE-2025-12343 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-63757 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-69693 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-10256 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶