Threat database

A vulnerability identified as CVE-2025-9951 affects FFmpeg versions prior to 8.0, specifically in the JPEG 2000 decoder where improper memory handling can lead to a heap buffer overflow. This flaw could allow an attacker to cause a denial of service or potentially leak sensitive information by tricking a user or application into opening a specially crafted media file. The issue is part of a broader set of FFmpeg vulnerabilities addressed in recent security advisories. Official patches are available through Ubuntu Pro via Extended Security Maintenance (ESM) for multiple Ubuntu LTS releases. Users are advised to update their FFmpeg packages accordingly to mitigate this risk.

A vulnerability in FFmpeg up to version 7.1 was discovered involving incorrect handling of LPC order calculation, leading to a stack-based buffer overflow. This flaw can cause FFmpeg to crash when processing specially crafted input, resulting in a denial of service. There is also a potential for code execution, although this is not explicitly confirmed. Ubuntu has released patches for various supported releases, with fixes available through standard updates or Ubuntu Pro Extended Security Maintenance (ESM). No known exploits are reported in the wild at this time.