Executive Summary

CVE-2025-9951 is a heap-buffer-overflow vulnerability in FFmpeg's JPEG2000 decoder (jpeg2000dec). It occurs when decoding JPEG2000 images with a crafted channel definition (cdef) atom, especially using chroma-subsampled pixel formats like YUV420P. The decoder mistakenly writes full-resolution luma data into a smaller chroma buffer, causing an out-of-bounds write of 1024 bytes beyond the allocated buffer. This memory corruption happens during the decoding process and can lead to crashes or exploitation. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to cause a denial of service by crashing the application processing the JPEG2000 images or potentially achieve remote code execution, which means the attacker could run arbitrary code on the affected system. This could compromise system integrity, confidentiality, and availability if exploited. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to decode a specially crafted JPEG2000 file that triggers the heap-buffer-overflow in the FFmpeg jpeg2000dec decoder. The advisory includes a proof-of-concept (PoC) JPEG2000 file encoded in base64 that causes an AddressSanitizer (ASAN) heap-buffer-overflow error during decoding. To detect it on your system, you can run FFmpeg with ASAN enabled and decode the PoC file to observe if the overflow occurs. Specific commands are not provided, but using ASAN-instrumented FFmpeg to decode suspicious JPEG2000 images is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the use or processing of untrusted JPEG2000 images, especially those containing the channel definition (cdef) atom. Since no patched FFmpeg versions were listed at the time of the advisory, you should monitor for updates and apply patches once available. Additionally, running FFmpeg in a sandboxed or restricted environment can reduce the risk of remote code execution or denial of service. [1]

Useful 0 Not Useful 0