A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jan 19, 2026 | Jan 19, 2026 |
| Ffmpeg | — | Upgrade to FFmpeg version 8.0 | Apr 17, 2026 | Feb 18, 2026 |
| Ubuntu | — | Upgrade libavcodec58 (Ubuntu Pro)Upgrade libavcodec57 (Ubuntu Pro)Upgrade libavformat60 (Ubuntu Pro)Upgrade ffmpeg (Ubuntu Pro)Upgrade libavformat57 (Ubuntu Pro)Upgrade libavcodec60 (Ubuntu Pro)Upgrade libavformat58 (Ubuntu Pro) | Oct 22, 2025 | Sep 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub