CVE-2025-56225
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jan 9, 2026
CISA due date
—
The record
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | fluidsynth | 0 | 2.3.5-160000.3.1 |
| openSUSE:Tumbleweed | fluidsynth | 0 | 2.5.2-2.1 |