ffmpeg (Alpine Linux) CVE-2025-59734

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:53 vuln.today

DescriptionCVE.org

Alpine Linux: ffmpeg fixed in 8.0-r0

AnalysisAI

ffmpeg on Alpine Linux was patched in package version 8.0-r0, addressing an unspecified vulnerability tracked as CVE-2025-59734. The nature of the flaw, affected attack surface, and attacker capabilities cannot be characterized from available data - no description, CVSS vector, or CWE has been published. EPSS scoring of 0.02% (6th percentile) indicates very low modeled exploitation probability at this time, and no public exploit or CISA KEV listing has been identified.

Technical ContextAI

ffmpeg is a widely used open-source multimedia framework for decoding, encoding, transcoding, and streaming audio and video. It has a long history of memory-safety vulnerabilities (buffer overflows, use-after-free, integer overflows) arising from its complex media format parsers. The specific root cause class (CWE) for this CVE has not been disclosed - no CWE identifier is available. The fix is scoped to Alpine Linux's packaging of ffmpeg, with the remediated package version being 8.0-r0. Whether the underlying vulnerability originates upstream in ffmpeg itself or is Alpine-specific has not been confirmed from available data.

Affected ProductsAI

ffmpeg as packaged in Alpine Linux is affected, with the fix delivered in Alpine's ffmpeg package version 8.0-r0. The specific Alpine Linux release branch(es) carrying the vulnerable package version have not been identified in available data. No upstream ffmpeg version range or CPE string has been provided. No vendor advisory URL beyond the Alpine Linux package tracker has been referenced in the intelligence data.

RemediationAI

Update the Alpine Linux ffmpeg package to version 8.0-r0 or later using the Alpine package manager: 'apk upgrade ffmpeg'. This is the vendor-confirmed fix per the Alpine Linux security report. No upstream patch version, advisory URL, or workaround information is available from current data. If immediate patching is not possible, consider restricting access to services or applications that process untrusted media files via ffmpeg until the update can be applied, though the specific attack vector is unconfirmed and this control's effectiveness cannot be guaranteed without further vulnerability details.