Skip to content

CVE-2025-10256 on CTRL-OS 26.05

Aliases: CVE-2025-10256

Packages: ffmpeg_8

Status: Plausible, Resolved

Advisory Information

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.

Updates

2026-08-01 00:22 CEST

Metadata changes:

  • Status for package ffmpeg_8: “Resolved”

(Amended on: 2026-08-01 00:31 CEST)

2026-08-01 00:22 CEST

Metadata changes:

  • Status for package ffmpeg_7: “Resolved”

(Amended on: 2026-08-01 00:31 CEST)

2026-08-01 00:22 CEST

Metadata changes:

  • Status for package ffmpeg_6: “Resolved”

(Amended on: 2026-08-01 00:31 CEST)

2026-08-01 00:22 CEST

Metadata changes:

  • Status for package ffmpeg_4: “Plausible”

(Amended on: 2026-08-01 00:31 CEST)

2026-07-31 01:07 CEST

Metadata changes:

  • Status for package ffmpeg_4: “New”
  • Status for package ffmpeg_6: “New”
  • Status for package ffmpeg_7: “New”
  • Status for package ffmpeg_8: “New”

(Amended on: 2026-08-01 00:22 CEST)