← Vulnerability feed

Vulnerability record · CVE-2025-56225 · published 9 January 2026

CVE-2025-56225: Fluidsynth null pointer dereference vulnerability

FFluidsynth · Fluidsynth

fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.

7.5 CVSS 3.1 High EPSS 0.47% · top 62.2% CWE-476 · NULL pointer dereference
7.5CVSS 3.1 base score
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/FluidSynth/fluidsynth/issues/1602 ExploitIssue Tracking
https://github.com/FluidSynth/fluidsynth/pull/1607 Issue Tracking
https://github.com/FluidSynth/fluidsynth/issues/1602 ExploitIssue Tracking

Track CVE-2025-56225 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.0CVE-2025-68617Fluidsynth use after free vulnerabilityFluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading …EPSS 0.21%5.5CVE-2021-21417Fluidsynth use after free vulnerabilityfluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be tr…EPSS 0.94%6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed

Source: NIST National Vulnerability Database (record CVE-2025-56225), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.