CVE-2025-69693
Out-of-Bounds Read in FFmpeg RV60 Decoder Causes Memory Crash
Publication date: 2026-03-16
Last updated on: 2026-03-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ffmpeg | ffmpeg | 8.0 |
| ffmpeg | ffmpeg | 8.0.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds read in the FFmpeg 8.0 and 8.0.1 RV60 video decoder, specifically in the file libavcodec/rv60dec.c. The issue arises because the quantization parameter (qp) validation only checks if qp is less than 0 but does not check if qp exceeds the upper bound.
The qp value can reach 65 due to the combination of a base value from the 6-bit frame header (maximum 63) plus an offset of 2. However, the array rv60_qp_to_idx, which qp indexes into, only has 64 elements (indices 0 to 63). This causes out-of-bounds array access in several functions (decode_cbp8, decode_cbp16, and get_c4x4_set), which can lead to memory disclosure or crashes.
A previous fix addressed validation only for intra frames, but this vulnerability affects all frames. The issue is fixed in the git master branch with an added upper bound check on qp to prevent it from exceeding 63.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory access during video decoding, which may cause memory corruption or application crashes.
Such memory corruption could potentially be exploited to disclose sensitive information from memory or cause denial of service by crashing the application using the vulnerable FFmpeg versions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade FFmpeg to a version that includes the fix for CVE-2025-69693.
The vulnerability affects FFmpeg versions 8.0 and 8.0.1. The fix is included in the git master commit 8abeb879df and will be part of FFmpeg 8.1.
Until you can upgrade, avoid processing untrusted RV60 video streams with vulnerable FFmpeg versions to reduce the risk of exploitation.