PT-2025-9210 · FFmpeg+3 · Ffmpeg+3

0X20Z · Published 2025-02-17 · Updated 2025-11-10 · CVE-2025-1816

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions FFmpeg versions up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb

Description A problematic vulnerability has been found in FFmpeg, affecting the function audio element obu of the file libavformat/iamf parse.c of the component IAMF File Handler. The manipulation of the argument num parameters leads to a memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply a patch with the identifier 0526535cd58444dd264e810b2f3348b4d96cff3b. As a temporary workaround, consider restricting access to the vulnerable function audio element obu until a patch is available. Avoid using the argument num parameters in the affected component IAMF File Handler to minimize the risk of exploitation.

Exploit

Fix

Improper Resource Release

Memory Leak

Weakness Enumeration

CWE-404

CWE-401

Related Identifiers

BDU:2025-03525

CVE-2025-1816

OPENSUSE-SU-2025:14974-1

USN-7538-1

Affected Products

Ffmpeg

Linuxmint

Red Os

Ubuntu

References · 40

• 🔥 https://trac.ffmpeg.org/attachment/ticket/11475/poc · Exploit
• 🔥 https://trac.ffmpeg.org/ticket/11475 · Exploit
• https://ubuntu.com/security/CVE-2025-22919 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1816 · Security Note
• https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0526535cd58444dd264e810b2f3348b4d96cff3b · Patch
• https://ubuntu.com/security/CVE-2025-22921 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-1816 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-1816 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03525 · Security Note
• https://ubuntu.com/security/CVE-2025-25473 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7538-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0518 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1816 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7538-1 · Vendor Advisory