FFmpeg CVE-2025-59728

The Alpine advisory ('ffmpeg fixed in 8.0-r0') specifies no concrete feature, codec, or configuration prerequisite, so the exact trigger condition is not available from the provided data and must be confirmed via the upstream Google issue tracker entry. Based solely on the supplied CVSS 4.0 vector, exploitation requires: adjacent-network positioning (AV:A - not routable internet-wide), pre-existing low-level privileges (PR:L - authenticated/local foothold needed), and satisfaction of high-complexity conditions (AC:H - likely specific input, timing, or memory-layout state). No user interaction is required (UI:N). The realistic limiting factors for defenders are the adjacency requirement, the privilege prerequisite, and the non-trivial trigger complexity, all of which substantially narrow the exploitable population below what the 8.7 score alone implies; the practical exposure is any host that decodes untrusted media with a vulnerable ffmpeg build reachable from an adjacent network.

Signals conflict on urgency. The CVSS 4.0 base score of 8.7 (High) is driven by VC:H/VI:H plus subsequent-system impact (SC:H/SI:H), consistent with a CWE-787 out-of-bounds write causing memory corruption in ffmpeg. However, the exploitability metrics temper this: AV:A limits reach to an adjacent/local network rather than the open internet, AC:H means a non-trivial, condition-dependent trigger, and PR:L requires the attacker to already hold some privileges. EPSS is 0.02% (6th percentile), indicating essentially no observed or predicted real-world exploitation activity, and the issue is NOT in CISA KEV and has no public exploit identified at time of analysis. These exploitation-likelihood signals (low EPSS, no KEV, no POC, AC:H, AV:A, PR:L) strongly outweigh the raw score for prioritization: this is a genuine high-impact memory-safety bug but not an emergency, drive-by threat. A key caveat: the Alpine advisory ('ffmpeg fixed in 8.0-r0') provides no root-cause detail, affected codec/demuxer, or exploitation path, and the provenance/derivation of the supplied CVSS 4.0 vector is unclear - the AV:A/PR:L profile is unusual for a typical ffmpeg media-parsing flaw (which is usually local file processing, AV:L/UI:R, or server-side upload processing, AV:N). Verify the vector and affected component against the upstream Google issue tracker entry before acting on the attack-vector assumption. Recommended handling: patch to ffmpeg 8.0-r0 in the normal maintenance cycle, prioritizing hosts that parse untrusted media over an adjacent network.

An attacker with low-level access on an adjacent network delivers a specially crafted media stream or file to a service that decodes it with ffmpeg, triggering an out-of-bounds write that corrupts process memory. Because the flaw is a CWE-787 memory-corruption bug with high confidentiality and integrity impact, a successful trigger could lead to code execution or data compromise in the decoding process. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) means the trigger is likely dependent on specific timing or input conditions.