CVE-2025-9951 is a heap buffer overflow vulnerability in FFmpeg's JPEG 2000 decoder caused by incorrect memory handling. This vulnerability can be triggered by processing a crafted media file, potentially leading to denial of service or information leakage. It affects FFmpeg versions prior to 8.0 and is included among several security issues fixed in recent Ubuntu security notices. The vendor advisory from Ubuntu indicates that fixes are available via Ubuntu Pro ESM packages for supported LTS versions. No direct evidence of exploitation in the wild has been reported. The vulnerability is part of a set of FFmpeg issues involving memory mismanagement and input validation flaws.

The vulnerability allows remote attackers to cause a denial of service or potentially leak sensitive information by exploiting a heap buffer overflow in the JPEG 2000 decoder of FFmpeg. This could disrupt multimedia processing applications relying on FFmpeg or expose data if a crafted file is processed. There is no confirmed exploitation in the wild. The impact is limited to systems using vulnerable FFmpeg versions and processing untrusted media files.

Official fixes for this vulnerability are available through Ubuntu Pro Extended Security Maintenance (ESM) for supported Ubuntu LTS releases (18.04, 20.04, 22.04, 24.04). Users should update their FFmpeg packages to the patched versions provided by Ubuntu Pro. For other distributions or environments, users should monitor vendor advisories for corresponding patches. Applying these updates will mitigate the risk of exploitation. No additional mitigation steps are indicated by the vendor advisory.