CVE-2025-9951
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-09
Assigner: Google Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ffmpeg | ffmpeg | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9951 is a heap-buffer-overflow vulnerability in FFmpeg's JPEG2000 decoder (jpeg2000dec). It occurs when decoding JPEG2000 images with a crafted channel definition (cdef) atom, especially using chroma-subsampled pixel formats like YUV420P. The decoder mistakenly writes full-resolution luma data into a smaller chroma buffer, causing an out-of-bounds write of 1024 bytes beyond the allocated buffer. This memory corruption happens during the decoding process and can lead to crashes or exploitation. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to cause a denial of service by crashing the application processing the JPEG2000 images or potentially achieve remote code execution, which means the attacker could run arbitrary code on the affected system. This could compromise system integrity, confidentiality, and availability if exploited. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to decode a specially crafted JPEG2000 file that triggers the heap-buffer-overflow in the FFmpeg jpeg2000dec decoder. The advisory includes a proof-of-concept (PoC) JPEG2000 file encoded in base64 that causes an AddressSanitizer (ASAN) heap-buffer-overflow error during decoding. To detect it on your system, you can run FFmpeg with ASAN enabled and decode the PoC file to observe if the overflow occurs. Specific commands are not provided, but using ASAN-instrumented FFmpeg to decode suspicious JPEG2000 images is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use or processing of untrusted JPEG2000 images, especially those containing the channel definition (cdef) atom. Since no patched FFmpeg versions were listed at the time of the advisory, you should monitor for updates and apply patches once available. Additionally, running FFmpeg in a sandboxed or restricted environment can reduce the risk of remote code execution or denial of service. [1]