Alpine Linux FFmpeg CVE-2025-59732

Exploitation requires the victim to process attacker-controlled media with a vulnerable ffmpeg build (pre-8.0-r0 on Alpine), consistent with UI:P (passive user interaction such as opening/auto-decoding a file or stream). The attack is constrained to an adjacent network (AV:A) rather than being fully remote, and AC:H indicates a specific, hard-to-meet condition in the parser must be met for the out-of-bounds write to trigger reliably. Limiting factors: no privileges are needed (PR:N, so unauthenticated), but the combination of adjacent-only reach, high attack complexity, and required victim interaction substantially narrows realistic exploitation. The exact vulnerable component (codec/demuxer) is not stated in the available data and should be confirmed from the ffmpeg 8.0 changelog.

Signals are consistent in pointing to a LOW real-world priority despite the high 8.7 CVSS 4.0 base score. The vector itself tempers the severity: AV:A restricts the attack to an adjacent network (not the full internet), AC:H flags that exploitation is technically difficult, and UI:P requires the victim to passively process attacker-supplied content - these combine to make reliable exploitation hard. Corroborating this, EPSS is 0.02% (6th percentile), among the lowest possible, and there is no CISA KEV listing and no public POC identified, so this is 'no public exploit identified at time of analysis.' The high VC:H/VI:H impacts (plus subsequent-system SC:H/SI:H, implying an out-of-bounds write that can corrupt memory beyond the decoder sandbox) are what inflate the score, which is typical of a memory-corruption CWE-787 bug. Net: this is a high-CVSS-but-low-real-risk issue in practice - serious if a targeted attacker invests effort, but not a widespread-exploitation emergency. Key caveat: the description ('Alpine Linux: ffmpeg fixed in 8.0-r0') contains NO technical detail; the affected codec/demuxer, the precise trigger, and the fixed upstream commit are all unconfirmed from the provided data and should be verified against the Google issue tracker reference and ffmpeg 8.0 changelog.

An attacker on the same adjacent network segment (or controlling a media source the victim reaches) crafts a malformed audio/video file or stream that triggers an out-of-bounds write in ffmpeg when the victim's application decodes it. Because UI:P applies, the victim need only open or auto-process the media in a tool that bundles ffmpeg (media player, transcoder, thumbnailer), after which memory corruption can lead to code execution or data compromise. No public exploit code has been identified, and AC:H indicates a reliable exploit would require significant effort.