FFmpeg CVE-2025-59731

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:53 vuln.today

DescriptionCVE.org

Alpine Linux: ffmpeg fixed in 8.0-r0

AnalysisAI

FFmpeg on Alpine Linux received a security fix packaged as version 8.0-r0 in the Alpine distribution. The nature of the underlying vulnerability - including its class, impact, and attack vector - is not disclosed in the available intelligence. EPSS places exploitation probability at 0.02% (6th percentile), indicating very low observed exploitation pressure at time of analysis. No active exploitation or public exploit code has been identified.

Technical ContextAI

FFmpeg is a widely deployed open-source multimedia framework used for decoding, encoding, transcoding, muxing, demuxing, streaming, filtering, and playback of audio and video. It is a common attack surface due to its complexity and breadth of format support (hundreds of codecs, containers, and protocols). The Alpine Linux package versioning scheme (8.0-r0) identifies the upstream FFmpeg major version 8.0 as the fixed release in the Alpine apk ecosystem. No CWE classification or CPE string was provided, so the root cause class - whether a memory safety issue, integer overflow, use-after-free, or other - cannot be determined from available data.

Affected ProductsAI

FFmpeg as packaged in Alpine Linux is affected, with the fix delivered in Alpine package version 8.0-r0. The specific Alpine Linux release branches (e.g., Alpine 3.x edge vs. stable) affected prior to this fix are not enumerated in available data. No CPE string was provided, and no upstream FFmpeg advisory or NVD entry with version range data is available. Administrators running FFmpeg via Alpine's apk package manager on versions prior to 8.0-r0 should assume exposure until vendor clarification is provided.

RemediationAI

Upgrade the FFmpeg Alpine Linux package to version 8.0-r0 or later using the Alpine package manager: 'apk update && apk upgrade ffmpeg'. This is the only confirmed fix identified at time of analysis, as reported by the Alpine Linux vendor. No specific workarounds are documented because the vulnerability's attack vector and triggering conditions are unknown - generic network or input restrictions cannot be responsibly recommended without knowing whether the flaw is triggered by media parsing, network stream processing, or another vector. Monitor the Alpine Linux security advisories (https://security.alpinelinux.org) and the FFmpeg project's official security page for additional details. No upstream FFmpeg advisory URL was available in the provided intelligence.