ffmpeg (Alpine Linux) CVE-2025-59732

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:53 vuln.today

DescriptionCVE.org

Alpine Linux: ffmpeg fixed in 8.0-r0

AnalysisAI

ffmpeg, as packaged in Alpine Linux, was patched in package version 8.0-r0 to address CVE-2025-59732. The underlying vulnerability type, root cause, and impact scope are not disclosed in available intelligence sources. No CVSS score, vector, or CWE has been assigned at the time of this analysis, making precise impact assessment impossible without consulting upstream ffmpeg or Alpine Linux security advisories directly. EPSS scoring at 0.02% (6th percentile) indicates very low observed exploitation probability.

Technical ContextAI

ffmpeg is a widely used open-source multimedia framework handling encoding, decoding, transcoding, streaming, and playback of audio and video. It is notoriously complex, processing attacker-controlled media input, and has historically been a high-frequency source of memory corruption, integer overflow, and out-of-bounds vulnerabilities. The affected package is the Alpine Linux distribution packaging of ffmpeg, fixed at Alpine package version 8.0-r0. No CWE is assigned in available data, so the root cause vulnerability class cannot be confirmed. CPE strings were not provided, preventing precise version scoping beyond the Alpine-specific package fix.

Affected ProductsAI

The affected product is the ffmpeg package as distributed by Alpine Linux, fixed in Alpine package version 8.0-r0. The specific upstream ffmpeg release version range affected is not confirmed in available data. No CPE strings were provided. Users running Alpine Linux with ffmpeg versions prior to 8.0-r0 should consult the Alpine Linux security tracker and the upstream ffmpeg project for clarification on which upstream versions are impacted.

RemediationAI

Upgrade the ffmpeg package on Alpine Linux to version 8.0-r0 or later using the standard Alpine package manager: 'apk upgrade ffmpeg'. This is the only confirmed fix identified from available data. No vendor advisory URL was included in the intelligence provided, so users should consult https://security.alpinelinux.org and the official Alpine Linux aports repository for additional context. If immediate patching is not possible and the vulnerability class were determined to involve media file parsing, a compensating control would be to restrict processing of untrusted media input to isolated, sandboxed environments - though this trade-off introduces operational complexity. No specific workarounds can be recommended without knowledge of the vulnerability type.