CVE-2025-56225 Null dereference in n/a
An attacker can cause a denial of service in applications using FluidSynth by providing a maliciously crafted MIDI file that triggers a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-56225?
CVE-2025-56225 is a high-severity vulnerability in n/a, published on 9 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
Weakness: CWE-476
Which versions are affected by CVE-2025-56225?
It affects 1 product.
Linux distribution packages (3)
fluidsynth openSUSE:Leap 16.0 | All versions | 2.3.5-160000.3.1 |
fluidsynth openSUSE:Tumbleweed | All versions | 2.5.2-2.1 |
musescore openSUSE:Tumbleweed | All versions | 4.7.4-1.1 |
Products include Fluidsynth Fluidsynth.
How do I fix CVE-2025-56225?
Upgrade to a fixed version.
Is CVE-2025-56225 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-56225 exists.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2025-56225, GHSA-qgg6-hj2r-3x43, OESA-2026-1065, OESA-2026-1066, OESA-2026-1067, OESA-2026-1068 and 6 more.