{"schemaVersion":3,"id":"USN-7538-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"ffmpeg vulnerabilities\n\nSimcha Kosman discovered that FFmpeg did not correctly handle certain\nreturn values. An attacker could possibly use this issue to leak\nsensitive information. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS\nand Ubuntu 24.10. (CVE-2025-0518)\n\nIt was discovered that FFmpeg did not correctly handle certain memory\noperations. A remote attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 24.10. (CVE-2025-1816)\n\nIt was discovered that FFmpeg contained a reachable assertion, which\ncould lead to a failure when processing certain AAC files. If a user or\nautomated system were tricked into opening a specially crafted AAC file,\nan attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.\n(CVE-2025-22919)\n\nIt was discovered that FFmpeg did not correctly handle certain memory\noperations. An attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,\nUbuntu 24.10 and Ubuntu 25.04. (CVE-2025-22921)\n\nIt was discovered that FFmpeg did not correctly handle certain memory\noperations. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 24.04 LTS, Ubuntu 24.10 and Ubuntu 25.04. (CVE-2025-25473)","dates":{"published":"2025-05-28T01:00:46.000Z","modified":"2026-06-25T13:32:30.582Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"ffmpeg","name":"ffmpeg","label":"ffmpeg","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/ffmpeg","purlType":"deb","versions":[{"text":"< 7:2.8.17-0ubuntu0.1+esm10","noFixRecorded":false,"fixedIn":null},{"text":"< 7:3.4.11-0ubuntu0.1+esm8","noFixRecorded":false,"fixedIn":null},{"text":"< 7:4.2.7-0ubuntu0.1+esm8","noFixRecorded":false,"fixedIn":null},{"text":"< 7:4.4.2-0ubuntu0.22.04.1+esm7","noFixRecorded":false,"fixedIn":null},{"text":"< 7:6.1.1-3ubuntu5+esm3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7:2.8.17-0ubuntu0.1+esm10 | < 7:3.4.11-0ubuntu0.1+esm8 | < 7:4.2.7-0ubuntu0.1+esm8 | < 7:4.4.2-0ubuntu0.22.04.1+esm7 | < 7:6.1.1-3ubuntu5+esm3","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-7538-1","label":"ubuntu.com/security/notices/USN-7538-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-0518","label":"ubuntu.com/security/CVE-2025-0518","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-1816","label":"ubuntu.com/security/CVE-2025-1816","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-22919","label":"ubuntu.com/security/CVE-2025-22919","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-22921","label":"ubuntu.com/security/CVE-2025-22921","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-25473","label":"ubuntu.com/security/CVE-2025-25473","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2025-0518","CVE-2025-1816","CVE-2025-22919","CVE-2025-22921","CVE-2025-25473"],"downstream":[],"duplicates":[],"related":["CVE-2025-0518","CVE-2025-1816","CVE-2025-22919","CVE-2025-22921","CVE-2025-25473"]},"timeline":[{"kind":"published","date":"2025-05-28T01:00:46.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-25T13:32:30.582Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T01:15:47.828Z","stale":false,"partial":false}}