CVE-2025-10256: Ffmpeg

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.

Affected products

• Ffmpeg Ffmpeg: from 3.2, before 8.0 (fixed in 8.0)

Published 2026-02-18. Last modified 2026-06-17.