CVE-2025-8586
BaseFortify
Publication date: 2025-08-05
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libav | libav | to 12.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a null pointer dereference in libav versions up to 12.3, specifically in the MPEG File Parser component's function ff_seek_frame_binary in the file /libavformat/utils.c. When processing malformed MPEG files, the function attempts to access an uninitialized (NULL) index_entries array without checking if it is NULL, causing a segmentation fault or crash. The vulnerability requires local access to exploit and can lead to application crashes, impacting availability. [1, 2]
How can this vulnerability impact me? :
The vulnerability can cause the affected application using libav to crash or exit unexpectedly due to a null pointer dereference when seeking in malformed MPEG files. This impacts the availability of the application or service relying on libav, potentially causing denial of service. Since the exploit requires local access, remote exploitation is not possible. There are no known countermeasures, and the affected libav versions are no longer supported. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the crash using a malformed MPEG file that triggers the null pointer dereference in libav's ff_seek_frame_binary function. A suggested command to test this is: avconv -ss 0.1 -i malformed_file -f null - where 'malformed_file' is a crafted MPEG file that causes the segmentation fault. Monitoring for segmentation faults or crashes in avconv or libav processes when processing MPEG files can also indicate the presence of this vulnerability. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of affected libav versions up to 12.3, especially when processing untrusted or malformed MPEG files. Since the affected versions are no longer supported and no known countermeasures exist, it is recommended to replace libav with an alternative multimedia processing product that is actively maintained and not vulnerable to this issue. [1]