CVE-2025-10256
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Feb 18, 2026
CISA due date
—
The record
A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | ffmpeg-7 | 0 | 7.1.4-160000.1.1 |
| openSUSE:Tumbleweed | ffmpeg-4 | 0 | 4.4.7-2.1 |
| openSUSE:Tumbleweed | ffmpeg-7 | 0 | 7.1.4-2.1 |
| openSUSE:Tumbleweed | ffmpeg-8 | 0 | 8.1.1-3.1 |
Related vulnerabilities
- CVE-2026-40962 FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC… Also affects ffmpeg-7
- CVE-2025-7700 A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for… Also affects ffmpeg-7
- CVE-2023-6601 A flaw was found in FFmpeg's HLS demuxer. Also affects ffmpeg-7
- CVE-2024-35366 FFmpeg n6.1.1 is Integer Overflow. Also affects ffmpeg-7
- CVE-2026-30997 An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg… Also affects ffmpeg-4
- CVE-2025-63757 Integer overflow vulnerability in the yuv2ya16_X_c_template function in… Also affects ffmpeg-4
- CVE-2025-0518 Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive… Also affects ffmpeg-4
- CVE-2024-36613 FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing… Also affects ffmpeg-4