CVE-2025-10256

Katalog CVE

CVSS 5.5 · Medium EPSS 0,32%

Kerentanan NULL Pointer Dereference pada ffmpeg. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.

Rincian

Terbit di NVD

18 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931 patch
• https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a patch
• https://access.redhat.com/security/cve/CVE-2025-10256 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2394495 advisory pihak ketiga