CVE-2025-22921
published 2025-02-18CVE-2025-22921: FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.
PriorityP425medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.35%
27.5th percentile
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | ffmpeg | < ffmpeg 7:4.3.8-0+deb11u3 (bullseye) | ffmpeg 7:4.3.8-0+deb11u3 (bullseye) |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | >= 0 < 7:4.3.8-0+deb11u3 | 7:4.3.8-0+deb11u3 |
| ffmpeg | ffmpeg | >= 0 < 7:8.0.1-2 | 7:8.0.1-2 |
| ffmpeg | ffmpeg | >= 0 < 7:2.8.17-0ubuntu0.1+esm10 | 7:2.8.17-0ubuntu0.1+esm10 |
| ffmpeg | ffmpeg | >= 0 < 7:3.4.11-0ubuntu0.1+esm8 | 7:3.4.11-0ubuntu0.1+esm8 |
| ffmpeg | ffmpeg | >= 0 < 7:4.2.7-0ubuntu0.1+esm8 | 7:4.2.7-0ubuntu0.1+esm8 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4.2-0ubuntu0.22.04.1+esm7 | 7:4.4.2-0ubuntu0.22.04.1+esm7 |
| ffmpeg | ffmpeg | >= 0 < 7:6.1.1-3ubuntu5+esm3 | 7:6.1.1-3ubuntu5+esm3 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ffmpeg vulnerabilities
osv·2025-05-28·CVSS 4.8
CVE-2025-0518 [MEDIUM] ffmpeg vulnerabilities
ffmpeg vulnerabilities
Simcha Kosman discovered that FFmpeg did not correctly handle certain
return values. An attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS
and Ubuntu 24.10. (CVE-2025-0518)
It was discovered that FFmpeg did not correctly handle certain memory
operations. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 24.10. (CVE-2025-1816)
It was discovered that FFmpeg contained a reachable assertion, which
could lead to a failure when processing certain AAC files. If a user or
automated system were tricked into opening a specially crafted AAC file,
an attacker c
GHSA
GHSA-j3v4-v6h2-f4pp: FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec
ghsa_unreviewed·2025-02-19
CVE-2025-22921 [MEDIUM] CWE-476 GHSA-j3v4-v6h2-f4pp: FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.
OSV
CVE-2025-22921: FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec
osv·2025-02-18·CVSS 6.5
CVE-2025-22921 [MEDIUM] CVE-2025-22921: FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.
Ubuntu
FFmpeg vulnerabilities
vendor_ubuntu·2025-05-28·CVSS 5.3
CVE-2025-1816 [MEDIUM] FFmpeg vulnerabilities
Title: FFmpeg vulnerabilities
Summary: Several security issues were fixed in FFmpeg.
Simcha Kosman discovered that FFmpeg did not correctly handle certain
return values. An attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS
and Ubuntu 24.10. (CVE-2025-0518)
It was discovered that FFmpeg did not correctly handle certain memory
operations. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 24.10. (CVE-2025-1816)
It was discovered that FFmpeg contained a reachable assertion, which
could lead to a failure when processing certain AAC files. If a user or
automated system were t
Debian
CVE-2025-22921: ffmpeg - FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation ...
vendor_debian·2025·CVSS 6.5
CVE-2025-22921 [MEDIUM] CVE-2025-22921: ffmpeg - FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation ...
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.
Scope: local
bookworm: open
bullseye: resolved (fixed in 7:4.3.8-0+deb11u3)
forky: resolved (fixed in 7:8.0.1-2)
sid: resolved (fixed in 7:8.0.1-2)
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-22921 ffmpeg: Segmentation Violation in FFmpeg [epel-all]
bugzilla·2025-02-19·CVSS 6.5
CVE-2025-22921 [MEDIUM] CVE-2025-22921 ffmpeg: Segmentation Violation in FFmpeg [epel-all]
CVE-2025-22921 ffmpeg: Segmentation Violation in FFmpeg [epel-all]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2346405
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
---
Fixed in 8.0: https://github.com/ffmpeg/ffmpeg/commit/7f9c7f9849a2155224711f0ff57ecdac6e4bfb57
7.1 is affected: https://github.com/FFmpeg/FFmpeg/blame/release/7.1/libavcodec/jpeg2000dec.c#L1541
5.1 code is different and may not be affected. Asked upstream t
Bugzilla
CVE-2025-22921 ffmpeg: Segmentation Violation in FFmpeg [fedora-43]
bugzilla·2025-02-19·CVSS 6.5
CVE-2025-22921 [MEDIUM] CVE-2025-22921 ffmpeg: Segmentation Violation in FFmpeg [fedora-43]
CVE-2025-22921 ffmpeg: Segmentation Violation in FFmpeg [fedora-43]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2346405
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2025-b17c2ce3ff (ffmpeg-7.1.1-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-b17c2ce3ff
---
FEDORA-2025-1aff9a0e04 (ffmpeg-7.1.1-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-1aff9a0e04
---
FEDORA-2025-ab5fe60520 (ffmpeg-7.1.1-1.fc4
2025-02-18
Published