PT-2025-3933 · FFmpeg+6 · Ffmpeg+6

Simcha Kosman · Published 2025-01-16 · Updated 2025-08-25 · CVE-2025-0518

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FFmpeg version 7.1

Description The issue is an Unchecked Return Value, Out-of-bounds Read vulnerability that allows reading sensitive constants within an executable. This vulnerability is associated with program files, specifically the af pan.C file in the libavfilter directory. The issue was discovered by Simcha Kosman.

Recommendations For FFmpeg version 7.1, update to a version that includes the fix committed at https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a to resolve the issue. As a temporary workaround, consider restricting access to sensitive constants within the executable until the update is applied.

Fix

Unchecked Return Value

Out of bounds Read

Weakness Enumeration

CWE-252

CWE-125

Related Identifiers

BDU:2025-06052

CVE-2025-0518

DLA-4073-1

DSA-5985-1

MGASA-2025-0085

OPENSUSE-SU-2025:14833-1

OPENSUSE-SU-2025:14834-1

OPENSUSE-SU-2025:15010-1

OPENSUSE-SU-2025_0862-1

OPENSUSE-SU-2025_1128-1

OPENSUSE-SU-2025_1450-1

OPENSUSE-SU-2026:20710-1

SUSE-SU-2025:0862-1

SUSE-SU-2025:1128-1

SUSE-SU-2025:1450-1

USN-7538-1

Affected Products

Astra Linux

Debian

Ffmpeg

Linuxmint

Red Os

Suse

Ubuntu

References · 95

• https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-0518 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1128-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-0518 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-1816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22921 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14834-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0518 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22919 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-25473 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14833-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0904SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/USN-7538-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06052 · Security Note
• https://osv.dev/vulnerability/DSA-5985-1 · Vendor Advisory