CVE-2025-9951
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A heap-buffer-overflow write in the JPEG2000 decoder in FFmpeg. An attacker could potentially achieve remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.
Risk Assessment
It can lead to arbitrary code execution or crash of applications processing malicious JPEG2000 files. Poses a significant risk to multimedia processing systems.
Recommendation
Update FFmpeg to a patched version. Avoid processing untrusted JPEG2000 files in critical systems.
Other vulnerabilities in FFmpeg
See all- CVE-2017-15672High
The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.
- CVE-2017-14767High
The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before version 3.3.4 mishandles empty sprop-parameter-sets values, allowing remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.
- CVE-2017-14225High
The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, leading to a NULL pointer dereference in the avcodec_string function in libavcodec/utils.c.
- CVE-2012-2805High
Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service.
- CVE-2017-11719High
The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg versions 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.
- CVE-2017-11665High
The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service via a crafted stream, leading to segmentation violation and application crash.
- CVE-2017-9996High
The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg before versions 2.8.12, 3.0.8, 3.1.8, 3.2.5, and 3.3.1 does not exclude the CHUNKY format, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- CVE-2017-9995High
In libavcodec/scpr.c in FFmpeg version 3.3 and earlier, before version 3.3.1, height and width data is not properly validated, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- CVE-2017-9993High
FFmpeg versions before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 do not properly restrict HTTP Live Streaming filename extensions and demuxer names, allowing attackers to read arbitrary files via crafted playlist data.
- CVE-2017-9992High
A heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
Original NVD description (English source)
A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS