CVE-2025-8584
BaseFortify
Publication date: 2025-08-05
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libav | libav | to 12.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8584 is a vulnerability in libav (up to version 12.3) affecting the AVI File Parser component, specifically the function av_buffer_unref in libavutil/buffer.c. It is a null pointer dereference issue where the software attempts to use a pointer that is NULL, causing the application to crash or exit unexpectedly. This happens when processing malformed AVI files encoded with the CFHD codec, due to the buffer management code calling a null release function pointer during cleanup. Exploitation requires local access and is considered easy to perform. The affected versions are no longer supported, and no known mitigations exist. [1, 2]
How can this vulnerability impact me? :
This vulnerability can cause denial of service by crashing the application (libav) when it processes specially crafted malformed AVI files. This crash results from a null pointer dereference during buffer cleanup, leading to a segmentation fault. Since exploitation requires local access, an attacker with such access can cause the application to terminate unexpectedly, impacting availability of the service or software relying on libav. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to process a malformed AVI file encoded with the CFHD codec using the avconv tool from libav. A command to trigger the vulnerability and observe a crash (segmentation fault) is: avconv -i malformed_cfhd.avi -f null - If the program crashes with a segmentation fault, it indicates the presence of the vulnerability. A proof-of-concept malformed AVI file is publicly available for testing. [2]
What immediate steps should I take to mitigate this vulnerability?
There are no known countermeasures or mitigations for this vulnerability as the affected libav versions are no longer supported by the maintainer. The suggested immediate step is to replace libav with an alternative product to avoid exposure to this vulnerability. [1]