CVE-2025-56225
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in...
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
- Record
CVE-2025-56225- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2026-1717
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
- Record
EUVD-2026-1717- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qgg6-hj2r-3x43
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in...
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
- Record
GHSA-qgg6-hj2r-3x43- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
- Record
CVE-2025-56225- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
- Record
CVE-2025-56225- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-56225
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
- Record
DEBIAN-CVE-2025-56225- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2026-1065
fluidsynth security update
FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.
Security Fix(es):
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.(CVE-2025-56225)
- Record
OESA-2026-1065- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1066
fluidsynth security update
FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.
Security Fix(es):
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.(CVE-2025-56225)
- Record
OESA-2026-1066- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1067
fluidsynth security update
FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.
Security Fix(es):
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.(CVE-2025-56225)
- Record
OESA-2026-1067- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1068
fluidsynth security update
FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.
Security Fix(es):
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.(CVE-2025-56225)
- Record
OESA-2026-1068- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1069
fluidsynth security update
FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.
Security Fix(es):
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.(CVE-2025-56225)
- Record
OESA-2026-1069- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1070
fluidsynth security update
FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.
Security Fix(es):
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.(CVE-2025-56225)
- Record
OESA-2026-1070- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-56225
fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file.
- Record
UBUNTU-CVE-2025-56225- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10038-1 No score
fluidsynth-2.5.2-2.1 on GA media
These are all security issues fixed in the fluidsynth-2.5.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10038-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11496-1 No score
musescore-4.7.4-1.1 on GA media
These are all security issues fixed in the musescore-4.7.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11496-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20291-1 No score
Security update for fluidsynth
This update for fluidsynth fixes the following issues:
- CVE-2025-56225: NULL pointer deference when loading and invalid MIDI file (bsc#1256435).
- Record
openSUSE-SU-2026:20291-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fluidsynthDebian:12 |
All versions, plus listed versions 2.3.1-22.3.2-12.3.3-12.3.3-22.3.3-2.1 Show 28 moreShow less2.3.4-12.3.5-12.3.6-12.4.0-12.4.0-1~hurd.12.4.0-1~hurd.22.4.2-12.4.3+dfsg-12.4.3+dfsg-22.4.3+dfsg-32.4.3+dfsg-42.4.3-12.4.4+dfsg-12.4.6+dfsg-12.4.7+dfsg-12.4.7+dfsg-22.4.8+dfsg-12.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-22.5.2+dfsg-12.5.3+dfsg-12.5.4+dfsg-12.5.5+dfsg-12.5.5+dfsg-22.5.6+dfsg-12.5.7+dfsg-12.6.0+dfsg-1 |
None known |
fluidsynthDebian:13 |
before 2.4.4+dfsg-1+deb13u2, plus listed versions 2.4.4+dfsg-12.4.4+dfsg-1+deb13u1 |
2.4.4+dfsg-1+deb13u2 |
fluidsynthDebian:14 |
before 2.4.7+dfsg-1, plus listed versions 2.4.4+dfsg-12.4.6+dfsg-1 |
2.4.7+dfsg-1 |
fluidsynthopenEuler:24.03-LTS-SP3 |
before 2.3.4-2.oe2403sp3 | 2.3.4-2.oe2403sp3 |
fluidsynthopenEuler:22.03-LTS-SP3 |
before 2.2.7-2.oe2203sp3 | 2.2.7-2.oe2203sp3 |
fluidsynthopenEuler:22.03-LTS-SP4 |
before 2.2.7-2.oe2203sp4 | 2.2.7-2.oe2203sp4 |
fluidsynthopenEuler:24.03-LTS |
before 2.3.4-2.oe2403 | 2.3.4-2.oe2403 |
fluidsynthopenEuler:24.03-LTS-SP1 |
before 2.3.4-2.oe2403sp1 | 2.3.4-2.oe2403sp1 |
fluidsynthopenEuler:24.03-LTS-SP2 |
before 2.3.4-2.oe2403sp2 | 2.3.4-2.oe2403sp2 |
fluidsynthUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.1.6-21.1.6-2ubuntu0.1~esm1 |
None known |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
fluidsynthUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.1.6-2build11.1.6-31.1.6-3ubuntu0.1~esm1 |
None known |
fluidsynthUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.6-41.1.8-11.1.8-21.1.8-31.1.9-11.1.9-1ubuntu0.1~esm1 |
None known |
fluidsynthUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.1.11-41.1.11-4ubuntu12.1.0-12.1.1-22.1.1-2ubuntu0.1~esm1 |
None known |
fluidsynthUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.1.7-1.12.2.4-22.2.5-12.2.5-1ubuntu0.1~esm1 |
None known |
fluidsynthUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.3.3-2.12.3.4-12.3.4-1build12.3.4-1build22.3.4-1build32.3.4-1ubuntu0.1~esm1 |
None known |
fluidsynthopenSUSE:Tumbleweed |
before 2.5.2-2.1 | 2.5.2-2.1 |
musescoreopenSUSE:Tumbleweed |
before 4.7.4-1.1 | 4.7.4-1.1 |
fluidsynthopenSUSE:Leap 16.0 |
before 2.3.5-160000.3.1 | 2.3.5-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-56225 is a high vulnerability (CVSS 7.5) in Fluidsynth, published January 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in fluidsynth 2.4.4+dfsg-1+deb13u2.
References
github.com/FluidSynth/fluidsynth/issues/1602
nvd.nist.gov/vuln/detail/CVE-2025-56225
security-tracker.debian.org/tracker/CVE-2025-56225
Show 10 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1065
ubuntu.com/security/CVE-2025-56225
cve.org/CVERecord?id=CVE-2025-56225
suse.com/security/cve/CVE-2025-56225
bugzilla.suse.com/1256435