PT-2025-6903 · FFmpeg · Ffmpeg

0X20Z · Published 2025-02-08 · Updated 2025-06-03 · CVE-2025-1373

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: FFmpeg versions prior to 7.1

Description: A problem has been found in the function mov read trak of the file libavformat/mov.c of the component MOV Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Recommendations: For FFmpeg versions prior to 7.1, apply a patch to fix this issue. As a temporary workaround, consider restricting access to the mov read trak function of the MOV Parser component until a patch is available.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2025-06797

CVE-2025-1373

Affected Products

Ffmpeg

References · 19

• 🔥 https://trac.ffmpeg.org/attachment/ticket/11460/poc · Exploit
• https://bdu.fstec.ru/vul/2025-06797 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-1373 · Vendor Advisory
• https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/43be8d07281caca2e88bfd8ee2333633e1fb1a13 · Patch
• https://ubuntu.com/security/CVE-2025-1373 · Vendor Advisory
• https://trac.ffmpeg.org/ticket/11460 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1373 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-1373 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1373 · Security Note
• https://vuldb.com/?id.295982 · Note
• https://t.me/cvedetector/18240 · Telegram Post
• https://vuldb.com/?ctiid.295982 · Note
• https://twitter.com/VulmonFeeds/status/1891352731954127116 · Twitter Post
• https://ffmpeg.org · Note