What is the CVSS score of CVE-2025-56225?

CVE-2025-56225 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Fluidsynth are affected by CVE-2025-56225?

Organizations using fluidsynth-2.4.6 and earlier versions face notable risk from CVE-2025-56225, a null pointer dereference vulnerability rated CVSS 7.5.. A patch is available.

Is there a public PoC exploit available for CVE-2025-56225?

Yes, a public proof-of-concept exploit is available for CVE-2025-56225. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-56225?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Fluidsynth CVE-2025-56225

HIGH

NULL Pointer Dereference (CWE-476)

2026-01-09 cve@mitre.org

Null Pointer Dereference Fluidsynth Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 06, 2026 - 20:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 23, 2026 - 02:13 vuln.today

Public exploit code

CVE Published

Jan 09, 2026 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.

AnalysisAI

fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-476 (NULL Pointer Dereference). Affects Fluidsynth. fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Fluidsynth

View all

CVE-2021-21417 MEDIUM This Month POC

5.5 Apr 29

fluidsynth is a software synthesizer based on the SoundFont 2 specifications. Rated medium severity (CVSS 5.5), this vul

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Null Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Vendor StatusVendor

SUSE

Severity: High

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.35 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.4 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.31 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.36 Container suse/sl-micro/6.0/toolbox:13.2-9.1 Image SL-Micro	Affected
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed

CVE-2025-56225 vulnerability details – vuln.today

Back

Fluidsynth CVE-2025-56225

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Fluidsynth

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Null Pointer Dereference

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code