FFmpeg CVE-2025-59728

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:54 vuln.today

DescriptionCVE.org

Alpine Linux: ffmpeg fixed in 8.0-r0

AnalysisAI

FFmpeg on Alpine Linux received a security fix packaged in version 8.0-r0 of the Alpine package repository. The underlying vulnerability details - including attack vector, affected component, and impact class - have not been publicly disclosed in NVD or vendor advisories available at time of analysis. EPSS scoring places this at the 6th percentile (0.02% exploitation probability), indicating very low likelihood of active or near-term exploitation.

Technical ContextAI

FFmpeg is a widely used open-source multimedia framework handling audio, video encoding/decoding, muxing, demuxing, and streaming. It processes untrusted media input by design, making it a historically high-target attack surface for memory corruption, integer overflow, and out-of-bounds read vulnerabilities. Alpine Linux packages FFmpeg as a core multimedia dependency used by many downstream Alpine-based containers and applications. The fix was released as Alpine package version 8.0-r0, corresponding to FFmpeg upstream 8.0. No CWE classification or affected component within FFmpeg has been disclosed for this CVE, making the root cause class unconfirmed.

Affected ProductsAI

FFmpeg as packaged by Alpine Linux is confirmed affected, with the fix delivered in Alpine package version 8.0-r0. Systems running Alpine Linux with FFmpeg installed at any version prior to the 8.0-r0 package release should be considered potentially affected. No upstream FFmpeg version range has been independently specified in the available data, and no CPE strings were provided. The fix is sourced from the Alpine Linux vendor advisory (vendor:alpine). Other Linux distributions packaging FFmpeg are not confirmed affected or unaffected based on available data.

RemediationAI

Upgrade the FFmpeg package on Alpine Linux to version 8.0-r0 or later using the Alpine package manager: 'apk upgrade ffmpeg'. This is the only confirmed remediation based on available data - the vendor:alpine source confirms the fix is present in the 8.0-r0 package. No specific workarounds have been published because the vulnerability details are not publicly disclosed. As a general compensating control pending upgrade, restricting FFmpeg processing of untrusted or externally supplied media files reduces exposure given FFmpeg's historical vulnerability surface. Alpine Linux users should consult the official Alpine package tracker for the advisory. No other advisory URL was available in the provided data.