CVE-2025-1816
published 2025-03-02CVE-2025-1816: A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu…
PriorityP421medium4.3CVSS 3.1
AVNACLPRNUIRSUCNINAL
EPSS
0.51%
40.2th percentile
A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ffmpeg | < ffmpeg 7:7.1.1-1 (forky) | ffmpeg 7:7.1.1-1 (forky) |
| ffmpeg | ffmpeg | >= 0 < 7:7.1.1-1 | 7:7.1.1-1 |
| ffmpeg | ffmpeg | >= 0 < 7:7.1.1-1 | 7:7.1.1-1 |
| ffmpeg | ffmpeg | >= 0 < 7:2.8.17-0ubuntu0.1+esm10 | 7:2.8.17-0ubuntu0.1+esm10 |
| ffmpeg | ffmpeg | >= 0 < 7:3.4.11-0ubuntu0.1+esm8 | 7:3.4.11-0ubuntu0.1+esm8 |
| ffmpeg | ffmpeg | >= 0 < 7:4.2.7-0ubuntu0.1+esm8 | 7:4.2.7-0ubuntu0.1+esm8 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4.2-0ubuntu0.22.04.1+esm7 | 7:4.4.2-0ubuntu0.22.04.1+esm7 |
| ffmpeg | ffmpeg | >= 0 < 7:6.1.1-3ubuntu5+esm3 | 7:6.1.1-3ubuntu5+esm3 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.3MEDIUM
vendor_debian5.3LOW
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ffmpeg vulnerabilities
osv·2025-05-28·CVSS 4.8
CVE-2025-0518 [MEDIUM] ffmpeg vulnerabilities
ffmpeg vulnerabilities
Simcha Kosman discovered that FFmpeg did not correctly handle certain
return values. An attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS
and Ubuntu 24.10. (CVE-2025-0518)
It was discovered that FFmpeg did not correctly handle certain memory
operations. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 24.10. (CVE-2025-1816)
It was discovered that FFmpeg contained a reachable assertion, which
could lead to a failure when processing certain AAC files. If a user or
automated system were tricked into opening a specially crafted AAC file,
an attacker c
OSV
CVE-2025-1816: A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb
osv·2025-03-02·CVSS 5.3
CVE-2025-1816 [MEDIUM] CVE-2025-1816: A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb
A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue.
GHSA
GHSA-77wf-7c6r-cx8j: A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb
ghsa_unreviewed·2025-03-02
CVE-2025-1816 [MEDIUM] CWE-401 GHSA-77wf-7c6r-cx8j: A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb
A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue.
Ubuntu
FFmpeg vulnerabilities
vendor_ubuntu·2025-05-28·CVSS 5.3
CVE-2025-1816 [MEDIUM] FFmpeg vulnerabilities
Title: FFmpeg vulnerabilities
Summary: Several security issues were fixed in FFmpeg.
Simcha Kosman discovered that FFmpeg did not correctly handle certain
return values. An attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS
and Ubuntu 24.10. (CVE-2025-0518)
It was discovered that FFmpeg did not correctly handle certain memory
operations. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 24.10. (CVE-2025-1816)
It was discovered that FFmpeg contained a reachable assertion, which
could lead to a failure when processing certain AAC files. If a user or
automated system were t
Debian
CVE-2025-1816: ffmpeg - A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57...
vendor_debian·2025·CVSS 5.3
CVE-2025-1816 [MEDIUM] CVE-2025-1816: ffmpeg - A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57...
A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 7:7.1.1-1)
sid: resolved (fixed in 7:7.1.1-1)
trixie: resolved (fixed in 7:7.1.1-1)
No detection rules found.
No public exploits indexed.
https://ffmpeg.org/https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0526535cd58444dd264e810b2f3348b4d96cff3bhttps://trac.ffmpeg.org/attachment/ticket/11475/pochttps://trac.ffmpeg.org/ticket/11475https://vuldb.com/?ctiid.298089https://vuldb.com/?id.298089https://vuldb.com/?submit.506575https://trac.ffmpeg.org/ticket/11475
2025-03-02
Published