CVE-2025-10256

Description

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.

PUBLISHED Reserved 2025-09-11 | Published 2026-02-18 | Updated 2026-02-18 | Assigner fedora

Problem types

NULL Pointer Dereference

Product status

Timeline

Credits

Red Hat would like to thank Jiasheng Jiang for reporting this issue.

References

access.redhat.com/security/cve/CVE-2025-10256 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2394495 (RHBZ#2394495) issue-tracking

github.com/...ommit/a25462482c02c004d685a8fcf2fa63955aaa0931

github.com/...ommit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a

cve.org (CVE-2025-10256)

nvd.nist.gov (CVE-2025-10256)

Download JSON