CVE-2025-10256: 
Ffmpeg vulnerability analysis and mitigation

CVE-2025-10256 is a NULL pointer dereference vulnerability in FFmpeg's Firequalizer audio filter (libavfilter/af_firequalizer.c). The flaw exists because the config_input() function does not check the return value of av_malloc_array() when allocating the dump_buf buffer, meaning a failed allocation can lead to a NULL pointer dereference and application crash. It affects FFmpeg versions 3.2 through versions prior to 8.0. The vulnerability was reported via Red Hat Bugzilla on September 11, 2025, and published to NVD on February 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Bugzilla, FFmpeg Patch).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference). The root cause was introduced in commit d3be186, which added dumpfile and dumpscale options to the Firequalizer filter and allocated s->dump_buf via av_malloc_array() without checking for allocation failure. If the allocation fails (e.g., under memory pressure), subsequent code that dereferences s->dump_buf will crash the process. Exploitation requires a local attack vector with user interaction — an attacker must trick a victim into processing a specially crafted media file with the Firequalizer filter enabled and the dumpfile option set. The fix, applied in commit a254624, adds a NULL check immediately after the av_malloc_array() call and returns AVERROR(ENOMEM) on failure (FFmpeg Patch, FFmpeg Origin Commit, Red Hat Bugzilla).

Successful exploitation results in a denial of service (DoS) through an application crash. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. The affected scope is the FFmpeg process handling the crafted media file; there is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Red Hat Bugzilla).

1. Craft a malicious media file: Prepare a media file that, when processed by FFmpeg with the Firequalizer filter, triggers the config_input() function under conditions where av_malloc_array() fails to allocate memory for s->dump_buf (e.g., by inducing memory pressure or crafting parameters that result in a very large allocation request).
2. Enable the Firequalizer filter with dumpfile option: Construct an FFmpeg command or configuration that applies the firequalizer filter with the dumpfile option set, which is the code path that triggers the vulnerable allocation.
3. Deliver the file to the victim: Social-engineer the victim into processing the crafted media file using a vulnerable FFmpeg version (3.2 through pre-8.0), for example via a media player, transcoding service, or automated pipeline that uses FFmpeg internally.
4. Trigger the crash: When FFmpeg processes the file and the allocation fails without the NULL check, the application dereferences the NULL pointer and crashes, achieving denial of service (FFmpeg Patch, Red Hat Bugzilla).

• Logs: FFmpeg process termination with a segmentation fault (SIGSEGV) or similar crash signal in system logs (e.g., /var/log/syslog, journalctl) when processing media files with the Firequalizer filter.
• Process: Unexpected crash of FFmpeg or any application embedding libavfilter, particularly when the firequalizer filter with dumpfile option is in use.
• File System: Presence of crafted or unexpected media files submitted to FFmpeg-based processing pipelines, especially those triggering the firequalizer filter with dumpfile parameters.

Upgrade FFmpeg to version 8.0 or later, which includes the fix in commit a254624 that adds a NULL check after av_malloc_array() in config_input(). As an interim workaround, disable the Firequalizer filter or avoid using the dumpfile option if it is not operationally required. Additionally, restrict processing of untrusted or externally sourced media files through FFmpeg pipelines. Downstream distributions including Debian and Ubuntu have issued security advisories and updated packages (FFmpeg Patch, Debian Advisory, Ubuntu Advisory).

The vulnerability received routine coverage from Linux distribution security teams, with Debian (DSA-6007-1, DLA-4440-1), Ubuntu (USN-7830-1), and openSUSE issuing security advisories for their respective FFmpeg packages. Splunk also published an advisory (SVD-2026-0309) referencing this CVE. Coverage was largely limited to automated security feeds and distribution update announcements, with no notable independent researcher commentary or significant social media discussion (Debian Advisory, Ubuntu Advisory, Splunk Advisory).