FFmpeg
CVE-2025-59734
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious media file
-
DeliveryDeliver to victim or transcoding service
-
ExploitTrigger use-after-free during decode
-
ExecutionCorrupt or reuse freed heap memory
-
ImpactDisclose memory or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application or pipeline using a vulnerable pre-8.0-r0 FFmpeg to decode attacker-controlled media; the victim must process that crafted file or stream (UI:P, passive user interaction). Limiting factors: high attack complexity (AC:H) implies the use-after-free depends on specific memory/timing conditions needing heap grooming, and the vendor-assigned adjacent vector (AV:A) would require link-local positioning rather than fully remote reach - though for FFmpeg this typically reduces to processing a malicious file, so the true vector should be confirmed upstream. No authentication is required (PR:N, unauthenticated). |
| Impact | Signals conflict, pointing to a serious-but-not-urgent issue. The vendor-supplied CVSS 4.0 score is 8.7 (High), driven by high confidentiality and integrity impact with a scope change (VC:H/VI:H/SC:H/SI:H), yet mitigated by high attack complexity (AC:H) and required passive user interaction (UI:P) over an adjacent vector (AV:A). EPSS is only 0.02% (6th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The AV:A (adjacent) choice is unusual for an FFmpeg media-parsing use-after-free, which is typically local (crafted file) or network (streamed) rather than link-local - verify the true attack surface with the upstream FFmpeg advisory. Net: a genuinely exploitable memory-corruption flaw in a ubiquitous library, but current telemetry indicates low near-term exploitation likelihood; prioritize patching because of FFmpeg's reach, not because of active-exploitation signals. |
| Exploit ScenarioDerived | An attacker crafts a malformed media file or stream that, when decoded by an application or service linking the vulnerable FFmpeg (versions prior to the Alpine 8.0-r0 fix), triggers a use-after-free in the affected component. A victim user or automated transcoding pipeline processes the attacker-supplied media (UI:P), freeing then reusing memory in a way that can disclose memory contents or corrupt the heap toward code execution. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires precise heap grooming. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 19, 2026
Use-after-free in Alpine Linux's FFmpeg package before 8.0-r0 can corrupt memory when the software decodes a crafted media file or stream, potentially leading to information disclosure or code execution within the decoding application. Exploitation requires the target to process attacker-controlled media and succeeds only under specific heap and timing conditions, making it high complexity; no public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.02%. The vendor CVSS 4.0 vector (adjacent, UI:P) and the independent CVSS 3.1 assessment (network, UI:R) differ, so exposure should be evaluated against the actual media-processing path.
Earlier versions of this analysis (1)
ffmpeg on Alpine Linux was patched in package version 8.0-r0, addressing an unspecified vulnerability tracked as CVE-2025-59734. The nature of the flaw, affected attack surface, and attacker capabilities cannot be characterized from available data - no description, CVSS vector, or CWE has been published. EPSS scoring of 0.02% (6th percentile) indicates very low modeled exploitation probability at this time, and no public exploit or CISA KEV listing has been identified.
RemediationAI
Vendor-released patch: FFmpeg 8.0-r0 in Alpine Linux. Upgrade the ffmpeg package to 8.0-r0 or later and rebuild or redeploy container images and build artifacts that bundle the affected Alpine package. If immediate upgrade is not possible, reduce exposure by preventing untrusted media files or streams from reaching FFmpeg decoders, running decoding in a sandboxed low-privilege service with memory protections, and restricting network-facing transcoding endpoints; these controls may break legitimate media workflows and do not remove the underlying flaw. Verify the fixed package version against the Alpine advisory and the issue tracker at https://issuetracker.google.com/440183164 or VulDB at https://vuldb.com/vuln/327263.
Affected ProductsAI
Alpine Linux's ffmpeg package is affected in versions earlier than 8.0-r0, which is the vendor-stated fixed release. No CPE strings were provided in the available intelligence, so administrators should identify exposure by package name and version rather than by CPE matching. Additional vendor and third-party context is available at https://issuetracker.google.com/440183164 and https://vuldb.com/vuln/327263.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FFmpeg is a widely used multimedia framework that handles demuxing, decoding, filtering, and encoding of many audio and video formats. The root cause class is CWE-416, use-after-free: memory that has already been freed is accessed again, which can corrupt heap state, leak data, or redirect execution depending on how the freed object is reused. The affected component is Alpine Linux's packaged FFmpeg before 8.0-r0; no CPE strings were supplied, so the package name and fixed release are the most specific product identifiers available. The independent assessment scores this as AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, while the vendor CVSS 4.0 vector reflects AV:A/UI:P with no availability impact, so reachability and exact scoring should be confirmed against the upstream fix and the application's media ingestion path.
Know when Ffmpeg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Crafted media is typically delivered remotely but requires the victim to process it (UI:R) and reliable UAF exploitation is race/layout-dependent (AC:H); memory corruption yields full C/I/A impact.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
2DescriptionCVE.org
Alpine Linux: ffmpeg fixed in 8.0-r0
Executive ViewAI
Alpine Linux systems running FFmpeg packages earlier than 8.0-r0 face a high-severity memory-corruption risk when decoding crafted media, which could affect data confidentiality or allow code execution inside the media-processing application. Teams operating Alpine-based containers or hosts that accept externally supplied audio or video are the primary audience, and leadership should care because these workloads often process untrusted content in shared environments. No public exploit identified at time of analysis, and exploitation requires attacker-controlled media plus specific heap and timing conditions.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or disable processing of untrusted media on Alpine FFmpeg versions earlier than 8.0-r0; sandbox decoding in disposable low-privilege containers; run as non-root with seccomp/AppArmor and resource limits; validate or transcode inbound media in an isolated environment; and monitor the vendor advisory for a confirmed fixed version.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
GitHub PoC
Exploit-DB