Is CVE-2025-10256 actively exploited?

No active exploitation of CVE-2025-10256 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-10256 be exploited remotely?

Yes. CVE-2025-10256 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-10256?

CVE-2025-10256 has a CVSS score of 5.3 (MEDIUM) and an EPSS exploitation probability of 0.05%.

HOME VULNERABILITIESCVE-2025-10256

MEDIUM

CVE-2025-10256

CWE-476Published: February 18, 2026· Updated: Feb 19, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.3th

Official Description

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.

NVD Source

Technical Analysis

CVE-2025-10256 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.