Threats affecting pkg:github/FFmpeg

FFmpeg versions 5.0 through 9.0.2 contain a path traversal vulnerability in the IMF demuxer. This flaw allows attackers to craft IMF packages with specially designed ASSETMAP Path elements containing '..' or absolute paths, enabling access to files outside the intended directory. Exploitation can lead to reading local MXF files, probing their existence and size, or triggering server-side requests.

CVE-2025-10256 is a medium-severity vulnerability in FFmpeg version 3.2 affecting the Firequalizer filter. It arises from a NULL pointer dereference caused by a missing check on the return value of av_malloc_array() in the config_input() function. Exploitation requires processing a crafted media file with the Firequalizer filter enabled, which can cause the application to crash and result in denial of service. There are no known exploits in the wild. No patch or official remediation details are provided in the available vendor advisory content.

A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free condition, potentially causing FFmpeg or any application using it to crash when processing TensorFlow-based DNN models. This results in a denial-of-service scenario but does not allow arbitrary code execution under normal conditions.