CVE-2025-12343
Double-Free Vulnerability in FFmpeg TensorFlow Backend Causes DoS
Publication date: 2026-02-18
Last updated on: 2026-02-26
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ffmpeg | ffmpeg | From 6.1 (inc) to 8.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-415 | The product calls free() twice on the same memory address. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "This vulnerability is a double-free flaw in FFmpeg's TensorFlow backend, specifically in the dnn_execute_model_tf() function. A task object is freed multiple times during certain error-handling paths, causing memory corruption. This improper memory management can lead to crashes when processing TensorFlow-based deep neural network models."}] [1]
How can this vulnerability impact me? :
The vulnerability can cause FFmpeg or any application using its TensorFlow DNN backend to crash, resulting in a denial-of-service (DoS) condition. An attacker can exploit this by supplying specially crafted data, triggering the double-free and causing the application to terminate unexpectedly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
This vulnerability causes a denial-of-service by crashing FFmpeg or applications using its TensorFlow DNN backend when processing specially crafted data. Immediate mitigation steps include avoiding the use of FFmpeg with TensorFlow DNN models on untrusted data and applying any available patches or updates from your Linux distribution or FFmpeg maintainers that address this double-free issue.
Since the vulnerability is triggered by processing crafted data, restricting or validating input data to FFmpeg processes can reduce risk. Monitoring for crashes or abnormal terminations of FFmpeg processes may also help detect exploitation attempts.