FFmpeg (Alpine Linux) CVE-2025-59730

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:53 vuln.today

DescriptionCVE.org

Alpine Linux: ffmpeg fixed in 8.0-r0

AnalysisAI

FFmpeg in Alpine Linux received a security fix in package version 8.0-r0, addressing an unspecified vulnerability with no published CVSS score, CWE classification, or technical description at time of analysis. The Alpine Linux vendor reported this CVE, indicating the fix is available in the Alpine package repository. With an EPSS score of 0.02% (6th percentile), no public exploit code identified, and no CISA KEV listing, real-world exploitation pressure appears low at this time.

Technical ContextAI

FFmpeg is a widely-used open-source multimedia framework capable of decoding, encoding, transcoding, muxing, demuxing, streaming, filtering, and playing almost any media format. It is frequently packaged by Linux distributions including Alpine Linux, which targets lightweight and container-focused deployments. The specific vulnerability class (CWE) is not available in the provided data, and no CPE string was supplied. Given FFmpeg's broad attack surface - including codec parsers, container format handlers, and protocol implementations - vulnerabilities in this product have historically spanned memory corruption, integer overflow, and out-of-bounds read/write categories, but none of these can be attributed to this CVE without a CWE or technical description.

Affected ProductsAI

The affected product is FFmpeg as packaged by Alpine Linux. The fix was introduced in Alpine Linux's ffmpeg package version 8.0-r0. Versions of the ffmpeg Alpine package prior to 8.0-r0 are considered affected. No CPE string was provided. No upstream FFmpeg version range, no advisory URL, and no other Linux distribution advisories were included in the available data.

RemediationAI

Update the Alpine Linux ffmpeg package to version 8.0-r0 or later using the Alpine package manager: 'apk upgrade ffmpeg'. This is the vendor-released patch per the Alpine Linux advisory. No upstream FFmpeg advisory URL or patch commit was provided in the available data, so the fix version cannot be independently cross-referenced against the upstream FFmpeg changelog. If immediate patching is not feasible and if ffmpeg is used to process untrusted media input (e.g., in an ingest pipeline or user-uploaded content service), consider restricting the input surface - limit accepted formats, enforce file size caps, or sandbox the ffmpeg process using seccomp or container isolation - until the patch can be applied. These workarounds reduce exposure but do not eliminate the underlying vulnerability.