{"id":"CVE-2025-25467","aliases":["DEBIAN-CVE-2025-25467","EUVD-2025-4692","GHSA-738r-f7wg-pq98","UBUNTU-CVE-2025-25467"],"status":"published","title":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows...","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00672,"percentile":0.52582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2025-02-18T00:00:00Z","modified":"2026-10-17T12:56:49Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.164.3095+gitbaee400-3","2:0.164.3108+git31e19f9-1","2:0.164.3108+git31e19f9-2","2:0.164.3108+git31e19f9-3","2:0.165.3222+gitb35605ac-1","2:0.165.3222+gitb35605ac-2","2:0.165.3222+gitb35605ac-3","2:0.165.3223+git20250910.0480cb0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.164.3108+git31e19f9-2","2:0.164.3108+git31e19f9-3","2:0.165.3222+gitb35605ac-1","2:0.165.3222+gitb35605ac-2","2:0.165.3222+gitb35605ac-3","2:0.165.3223+git20250910.0480cb0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.164.3108+git31e19f9-2","2:0.164.3108+git31e19f9-3","2:0.165.3222+gitb35605ac-1","2:0.165.3222+gitb35605ac-2","2:0.165.3222+gitb35605ac-3","2:0.165.3223+git20250910.0480cb0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.123.2189+git35cf912-1ubuntu1","2:0.123.2189+git35cf912-1ubuntu2","2:0.123.2189+git35cf912-1ubuntu3","2:0.123.2189+git35cf912-1ubuntu4","2:0.142.2389+git956c8d8-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8","7:2.8.17-0ubuntu0.1+esm9","7:2.8.17-0ubuntu0.1+esm10","7:2.8.17-0ubuntu0.1+esm11","7:2.8.17-0ubuntu0.1+esm12","7:2.8.17-0ubuntu0.1+esm13","7:2.8.17-0ubuntu0.1+esm14","7:2.8.17-0ubuntu0.1+esm15","7:2.8.17-0ubuntu0.1+esm16","7:2.8.17-0ubuntu0.1+esm17","7:2.8.17-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.146.2555+git0c21480-1","2:0.148.2601+gita0cd7d3-3","2:0.148.2643+git5c65704-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14","7:3.4.11-0ubuntu0.1+esm15","7:3.4.11-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.148.2795+gitaaa9aa8-1","2:0.152.2854+gite9a5903-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16","7:4.2.7-0ubuntu0.1+esm17","7:4.2.7-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.155.2917+git0a84d98-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.160.3011+gitcde9a93-2.1","2:0.160.3011+gitcde9a93-2.1build1","2:0.163.3060+git5db6aa6-2","2:0.163.3060+git5db6aa6-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14","7:4.4.2-0ubuntu0.22.04.1+esm15","7:4.4.2-0ubuntu0.22.04.1+esm16","7:4.4.2-0ubuntu0.22.04.1+esm17"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.164.3095+gitbaee400-3build1","2:0.164.3108+git31e19f9-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7","7:6.1.1-3ubuntu5+esm8","7:6.1.1-3ubuntu5+esm10","7:6.1.1-3ubuntu5+esm11","7:6.1.1-3ubuntu5+esm12","7:6.1.1-3ubuntu5+esm13","7:6.1.1-3ubuntu5+esm15"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu1","7:7.1.1-1ubuntu2","7:7.1.1-1ubuntu3","7:7.1.1-1ubuntu4","7:7.1.1-1ubuntu4.1","7:7.1.1-1ubuntu4.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.164.3108+git31e19f9-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.165.3222+gitb35605ac-3build1","2:0.165.3223+git20250910.0480cb0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"x264","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.164.3108+git31e19f9-2build2","2:0.165.3222+gitb35605ac-3","2:0.165.3222+gitb35605ac-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3","7:8.0.1-3ubuntu2+esm4","7:8.0.1-3ubuntu2+esm5"]}],"references":[{"url":"https://code.videolan.org/videolan/x264/-/issues/75","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467"},{"url":"https://github.com/advisories/GHSA-738r-f7wg-pq98"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-25467","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-25467","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-25467","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.","status":"published","published":"2025-02-18T00:00:00Z","modified":"2025-02-19T14:39:01.918Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:31.971896Z"}],"euvd":[{"id":"EUVD-2025-4692","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.","status":"published","published":"2025-02-18T00:00:00Z","modified":"2025-02-19T14:39:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:27.843209Z"}],"ghsa":[{"id":"GHSA-738r-f7wg-pq98","title":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows...","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.","status":"published","published":"2025-02-19T00:31:16Z","modified":"2025-02-19T15:33:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:59:59.153661Z"}],"nvd":[{"id":"CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.","status":"published","published":"2025-02-18T22:15:18.373Z","modified":"2026-06-17T09:00:48.443Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"DEBIAN-CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.","status":"published","published":"2025-02-18T22:15:18.373Z","modified":"2026-09-01T20:05:45.398148154Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"UBUNTU-CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.","status":"published","published":"2025-02-18T22:15:00Z","modified":"2026-10-17T12:56:49.015327056Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.","status":"published","published":"2025-02-18T22:15:18Z","modified":"2026-04-10T05:23:17.256163Z","updated_at":"2026-11-02T15:44:47.386092Z"}]}}