5.5

CVE-2025-10256: ffmpeg NULL Pointer Dereference

CVSS: 5.5v3.1MediumAnalyzed
AliasesSUSE-SU-2026:3149-1UBUNTU-CVE-2025-10256DEBIAN-CVE-2025-10256
Published 18-02-2026Last modified 25-02-2026
Open JSON

Vulnerability summary

CVE-2025-10256 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in ffmpeg. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.8% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.35%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 8
DLA-4440-1DSA-6007-1OPENSUSE-SU-2026:10866-1OPENSUSE-SU-2026:10867-1OPENSUSE-SU-2026:10890-1OPENSUSE-SU-2026:11515-1

Timeline

  1. 18-02-2026
    PublishedVulnerability first disclosed.
  2. 25-02-2026
    Last modifiedVulnerability information updated.

Description

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

+0.04 pp

From 0.31% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard9 products
  • eco-python-ffmpeg-6-minimalAll versions (No fix recorded)
  • eco-python-ffmpeg-6-minimal-devAll versions (No fix recorded)
  • eco-python-ffmpeg-6-minimal-staticAll versions (No fix recorded)
  • eco-python-ffmpeg-7-minimalAll versions (No fix recorded)
  • eco-python-ffmpeg-7-minimal-devAll versions (No fix recorded)
Suse3 products
  • ffmpeg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7< 3.4.2-150200.11.70.1
  • ffmpeg&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 3.4.2-150200.11.70.1
  • ffmpeg&distro=SUSE Linux Enterprise Workstation Extension 15 SP7< 3.4.2-150200.11.70.1
Wolfi2 products
  • ffmpeg-7All versions (No fix recorded)
  • ffmpeg-7.1All versions (No fix recorded)
Debian1 product
  • ffmpegAll versions (No fix recorded) | < 7:7.1.2-0+deb13u1 | < 7:7.1.2-1
Ffmpeg1 product
Ubuntu1 product
  • ffmpeg< 7:3.4.11-0ubuntu0.1+esm11 | < 7:4.2.7-0ubuntu0.1+esm11 | < 7:4.4.2-0ubuntu0.22.04.1+esm10 | < 7:6.1.1-3ubuntu5+esm6 | All versions (No fix recorded)

6 vendors · 17 products

References

14 links
Show all 14 references