FFmpeg (Alpine Linux) CVE-2025-59729

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:53 vuln.today

DescriptionCVE.org

Alpine Linux: ffmpeg fixed in 8.0-r0

AnalysisAI

FFmpeg on Alpine Linux received a security fix in package version 8.0-r0, addressing an unspecified vulnerability tracked as CVE-2025-59729. The nature of the flaw, its impact, and the affected component within FFmpeg are not disclosed in the available intelligence. With an EPSS score of 0.02% (6th percentile), exploitation probability is currently assessed as very low, though this signal is unreliable without knowing the vulnerability class or attack surface.

Technical ContextAI

FFmpeg is a widely deployed open-source multimedia framework used for video/audio encoding, decoding, transcoding, streaming, and filtering. It is packaged in Alpine Linux as 'ffmpeg' and is commonly included in containerized workloads, media servers, and CI pipelines. The specific component, protocol, library (e.g., libavcodec, libavformat, libswscale), or media format affected by this CVE is not identified in the available data. No CWE is assigned, so the root cause class - whether memory corruption, integer overflow, use-after-free, injection, or other - cannot be determined from current intelligence.

Affected ProductsAI

FFmpeg as packaged in Alpine Linux is confirmed affected, with the fix delivered in Alpine package version 8.0-r0. The upstream FFmpeg version range that is vulnerable is not specified in available data. No CPE strings were provided. The scope of affectation - whether limited to Alpine Linux's packaging or reflecting an upstream FFmpeg vulnerability - is not confirmed. Organizations using FFmpeg from other distributions or upstream builds should monitor the FFmpeg project security advisories independently.

RemediationAI

Upgrade the Alpine Linux ffmpeg package to version 8.0-r0 or later using the standard Alpine package manager: 'apk update && apk upgrade ffmpeg'. This is the only confirmed fix identified in available data. No exact upstream FFmpeg version corresponding to this fix has been independently verified. No vendor advisory URL was provided in the intelligence data. In the absence of patch details, compensating controls should be tailored to deployment context: restrict FFmpeg to processing only trusted media sources, isolate FFmpeg processes in sandboxed environments (e.g., seccomp profiles, containers with dropped capabilities), and avoid exposing FFmpeg-based services directly to untrusted network input until the vulnerability class is clarified.