FFmpeg CVE-2025-59733

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:53 vuln.today

DescriptionCVE.org

Alpine Linux: ffmpeg fixed in 8.0-r0

AnalysisAI

FFmpeg received a security fix in Alpine Linux package version 8.0-r0, addressing an unspecified vulnerability in the widely-used multimedia processing framework. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence - no CVSS score, CWE classification, or vulnerability description has been published at time of analysis. With an EPSS score of 0.02% (7th percentile), automated exploitation at scale is considered unlikely based on current signals, though this assessment is constrained by the near-total absence of technical detail.

Technical ContextAI

FFmpeg is an open-source multimedia framework used extensively for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playback of audio and video. It processes a wide variety of codecs and container formats, and historically has been a common source of memory safety vulnerabilities (buffer overflows, use-after-free, integer overflows) due to its extensive C codebase and complex input parsing logic. The affected package is distributed via Alpine Linux's apk package manager; the fix version '8.0-r0' refers to FFmpeg upstream version 8.0 packaged at Alpine revision r0. No CPE string, CWE classification, or upstream CVE advisory was provided, so the specific component (libavcodec, libavformat, libavfilter, etc.) and root cause class cannot be determined from available data.

Affected ProductsAI

The affected product is FFmpeg as packaged by Alpine Linux, with the vulnerable version being any Alpine FFmpeg package prior to 8.0-r0. This corresponds to FFmpeg upstream version 8.0 at Alpine package revision r0. No CPE string was provided with this advisory. The exact range of affected upstream FFmpeg versions (e.g., whether earlier major versions such as 7.x or 6.x are also affected) is unknown from available data. Users running FFmpeg on Alpine Linux should consult the Alpine Linux security tracker for the specific package advisory.

RemediationAI

Upgrade the FFmpeg package on Alpine Linux to version 8.0-r0 or later using 'apk upgrade ffmpeg'. This is the vendor-confirmed fixed version per the Alpine Linux advisory. No specific workarounds, mitigations, or compensating controls can be recommended because the vulnerability type, affected component, and attack surface are undisclosed. If immediate patching is not feasible, restricting untrusted or user-supplied media files from being processed by FFmpeg is a general precautionary measure, given FFmpeg's historical exposure surface in media parsing - however, this is a generic precaution and not a confirmed mitigation for this specific CVE. No upstream FFmpeg advisory URL was included in the provided intelligence.