{"id":"CVE-2025-7700","aliases":["DEBIAN-CVE-2025-7700","DLA-4440-1","DSA-5985-1","DSA-6007-1","EUVD-2025-38295","GHSA-p7g8-g57p-r8qx","MGASA-2025-0306","OESA-2025-2905","OESA-2025-2906","OESA-2025-2907","OESA-2026-3084","OESA-2026-3085","ROOT-OS-DEBIAN-11-CVE-2025-7700","SUSE-SU-2025:02972-1","SUSE-SU-2025:02990-1","SUSE-SU-2025:03162-1","SUSE-SU-2025:2990-1","SUSE-SU-2025:3715-1","SUSE-SU-2026:20932-1","UBUNTU-CVE-2025-7700","USN-7830-1","USN-7871-1","openSUSE-SU-2025:15396-1","openSUSE-SU-2025:15427-1","openSUSE-SU-2026:20420-1","openSUSE-SU-2026:20710-1"],"status":"published","title":"Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00393,"percentile":0.3378,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2025-07-18T00:00:00Z","modified":"2026-11-05T14:10:00Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:5.1.7-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:7.1.2-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:7.1.2-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","fixed_in":["6.1.1-24.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"ffmpeg","fixed_in":["6.1.1-24.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"ffmpeg","fixed_in":["6.1.1-24.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg-4","fixed_in":["4.4.6-150600.13.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg-4","fixed_in":["4.4.6-150600.13.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg-4","fixed_in":["4.4.6-150600.13.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg-4","fixed_in":["4.4.6-150600.13.30.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg-4","fixed_in":["4.4.6-150600.13.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"ffmpeg","fixed_in":["3.4.2-150200.11.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ffmpeg-7","fixed_in":["7.1.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ffmpeg-7","fixed_in":["7.1.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","fixed_in":["7:6.1.1-3ubuntu5+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"ffmpeg","fixed_in":["7:7.1.1-1ubuntu4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","fixed_in":["7.1.1-8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","fixed_in":["4.4.6-5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"ffmpeg-7","fixed_in":["7.1.2-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.7-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.2-0+deb13u1"}]}],"versions":["7:7.1.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.2-1"}]}],"versions":["7:7.1.1-1"]},{"source":"osv","ecosystem":"Debian:11","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3.9-0+deb11u2"}]}],"versions":["7:4.3.2-0+deb11u2","7:4.3.2-1","7:4.3.2-2","7:4.3.3-0+deb11u1","7:4.3.4-0+deb11u1","7:4.3.5-0+deb11u1","7:4.3.6-0+deb11u1","7:4.3.7-0+deb11u1","7:4.3.8-0+deb11u1","7:4.3.8-0+deb11u2","7:4.3.8-0+deb11u3","7:4.3.9-0+deb11u1"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.7-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1"],"bundled":16},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.2-0+deb13u1"}]}],"versions":["7:7.1.1-1"],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7-1.mga9"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7-1.mga9.tainted"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-24.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-24.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-24.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-43.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-43.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150400.3.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150400.3.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150400.3.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150400.3.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.30.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14","7:3.4.11-0ubuntu0.1+esm15","7:3.4.11-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16","7:4.2.7-0ubuntu0.1+esm17","7:4.2.7-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:6.1.1-3ubuntu5+esm6"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.1-1ubuntu4.1"}]}],"versions":["7:7.1.1-1ubuntu1","7:7.1.1-1ubuntu2","7:7.1.1-1ubuntu3","7:7.1.1-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.11-0ubuntu0.1+esm11"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm11"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm10"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:6.1.1-3ubuntu5+esm6"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.1-1ubuntu4.1"}]}],"versions":["7:7.1.1-1ubuntu1","7:7.1.1-1ubuntu2","7:7.1.1-1ubuntu3","7:7.1.1-1ubuntu4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2-160000.1.1"}]}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-7700","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380420","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p7g8-g57p-r8qx"},{"url":"https://github.com/FFmpeg/FFmpeg/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7700.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-7700","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0306.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34757","tags":["report"]},{"url":"https://ffmpeg.org/security.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00149.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2905","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2906","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2907","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3085","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502972-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234018","tags":["report"]},{"url":"https://bugzilla.suse.com/1234019","tags":["report"]},{"url":"https://bugzilla.suse.com/1234020","tags":["report"]},{"url":"https://bugzilla.suse.com/1245313","tags":["report"]},{"url":"https://bugzilla.suse.com/1246790","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7700","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502990-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503162-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20252990-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253715-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226308","tags":["report"]},{"url":"https://bugzilla.suse.com/1251137","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59728","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620932-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-7700","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-7700","tags":["report"]},{"url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7830-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7871-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-6603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-9951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-10256","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198898","tags":["report"]},{"url":"https://bugzilla.suse.com/1220545","tags":["report"]},{"url":"https://bugzilla.suse.com/1223304","tags":["report"]},{"url":"https://bugzilla.suse.com/1226892","tags":["report"]},{"url":"https://bugzilla.suse.com/1226897","tags":["report"]},{"url":"https://bugzilla.suse.com/1226898","tags":["report"]},{"url":"https://bugzilla.suse.com/1226899","tags":["report"]},{"url":"https://bugzilla.suse.com/1226900","tags":["report"]},{"url":"https://bugzilla.suse.com/1226901","tags":["report"]},{"url":"https://bugzilla.suse.com/1230983","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22919","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-7700","title":"Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.","status":"published","published":"2025-11-07T18:59:28.962Z","modified":"2026-05-06T14:38:29.969Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:51.880027Z"}],"euvd":[{"id":"EUVD-2025-38295","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.","status":"published","published":"2025-11-07T18:59:28Z","modified":"2026-05-06T14:38:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:05:16.191098Z"}],"ghsa":[{"id":"GHSA-p7g8-g57p-r8qx","title":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory...","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.","status":"published","published":"2025-11-07T21:31:21Z","modified":"2026-05-06T18:31:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:07:55.247215Z"}],"nvd":[{"id":"CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.","status":"published","published":"2025-11-07T19:16:27.923Z","modified":"2026-11-05T14:10:00.273Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-05T19:55:51.56159Z"}],"osv":[{"id":"CVE-2025-7700","title":"Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.","status":"published","published":"2025-11-07T18:59:28.962Z","modified":"2026-11-07T07:03:46.119686805Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-07T03:07:58.953998Z"},{"id":"DEBIAN-CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.","status":"published","published":"2025-11-07T19:16:27.923Z","modified":"2026-09-01T20:05:58.880752749Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"OESA-2025-2905","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.(CVE-2025-7700)","status":"published","published":"2025-12-30T11:10:02Z","modified":"2026-08-18T01:19:24.617780166Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2906","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.(CVE-2025-7700)","status":"published","published":"2025-12-30T11:10:02Z","modified":"2026-08-18T01:19:25.034646094Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2907","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.(CVE-2025-7700)","status":"published","published":"2025-12-30T11:10:02Z","modified":"2026-08-18T01:19:25.158542027Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-3084","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg\u0026apos;s HLS playlist parsing. This vulnerability allows a denial of service via a maliciously crafted HLS playlist that triggers a null pointer dereference during initialization.(CVE-2023-6603)\n\nUnchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman(CVE-2025-0518)\n\nA NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.(CVE-2025-10256)\n\nA vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-1594)\n\nA flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.(CVE-2025-7700)\n\nA heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.(CVE-2026-30999)\n\nA flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser\u0026apos;s fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.(CVE-2026-6385)","status":"published","published":"2026-07-19T11:11:58Z","modified":"2026-08-18T01:21:20.216644915Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3085","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg\u0026apos;s HLS playlist parsing. This vulnerability allows a denial of service via a maliciously crafted HLS playlist that triggers a null pointer dereference during initialization.(CVE-2023-6603)\n\nUnchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman(CVE-2025-0518)\n\nA NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.(CVE-2025-10256)\n\nA vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.(CVE-2025-1594)\n\nA flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.(CVE-2025-7700)\n\nA heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.(CVE-2026-30999)\n\nA flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser\u0026apos;s fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.(CVE-2026-6385)","status":"published","published":"2026-07-19T11:11:58Z","modified":"2026-08-18T01:21:20.394159481Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.","status":"published","published":"2025-07-18T00:00:00Z","modified":"2026-10-13T02:51:38.258803145Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"DLA-4440-1","title":"ffmpeg - security update","status":"published","published":"2026-01-16T00:00:00Z","modified":"2026-01-17T00:30:05.565408Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5985-1","title":"ffmpeg - security update","status":"published","published":"2025-08-25T00:00:00Z","modified":"2026-03-09T02:10:26.171906Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6007-1","title":"ffmpeg - security update","status":"published","published":"2025-09-21T00:00:00Z","modified":"2026-03-09T02:09:39.708124Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0306","title":"Updated ffmpeg packages fix security vulnerabilities","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a\nparameter of negative size in the av_samples_set_silence function in\nthelibavutil/samplefmt.c:260:9 component. (CVE-2023-50007)\nFFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the\ncolorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9\ncomponent. (CVE-2023-50008)\nImproper handling of input format in tty demuxer of ffmpeg.\n(CVE-2023-6602)\nHls xbin demuxer dos amplification in ffmpeg. (CVE-2023-6604)\nDash playlist ssrf vulnerability in ffmpeg. (CVE-2023-6605)\nFFmpeg version n6.1 was discovered to contain a heap buffer overflow\nvulnerability in the draw_block_rectangle function of\nlibavfilter/vf_codecview.c. This vulnerability allows attackers to cause\nundefined behavior or a Denial of Service (DoS) via crafted input.\n(CVE-2024-31582)\nFFmpeg n6.1.1 has an Out-of-bounds Read via\nlibavcodec/ppc/vp8dsp_altivec.c, static const vec_s8\nh_subpel_filters_outer. (CVE-2024-35367)\nHeap-buffer-overflow write in FFmpeg MDASH resolve_content_path.\n(CVE-2025-59728)\nHeap-buffer-overflow write in FFmpeg EXR dwa_uncompress.\n(CVE-2025-59731, CVE-2025-59732, CVE-2025-59733)\nNull pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c).\n(CVE-2025-7700)\n","status":"published","published":"2025-11-21T19:56:16Z","modified":"2026-04-16T04:44:27.513245693Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15396-1","title":"ffmpeg-7-7.1.1-8.1 on GA media","description":"These are all security issues fixed in the ffmpeg-7-7.1.1-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-30T00:00:00Z","modified":"2026-03-23T04:53:43.493147Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15427-1","title":"ffmpeg-4-4.4.6-5.1 on GA media","description":"These are all security issues fixed in the ffmpeg-4-4.4.6-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-09T00:00:00Z","modified":"2026-03-23T04:53:46.104013Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20420-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- Updated to version 7.1.2:\n  * avcodec/librsvgdec: fix compilation with librsvg 2.50.3\n  * libavfilter/af_firequalizer: Add check for av_malloc_array()\n  * avcodec/libsvtav1: unbreak build with latest svtav1\n  * avformat/hls: Fix Youtube AAC\n  * Various bugfixes.\n  * CVE-2025-7700: Fixed NULL Pointer Dereference in ALS Decoder (bsc#1246790)\n","status":"published","published":"2026-03-25T10:03:00Z","modified":"2026-03-29T17:26:33.602524Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20710-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\nChanges in ffmpeg-4:\n\n- CVE-2025-59728: Fixed out-of-bounds NUL-byte write when calculating the content path in handling of MPEG-DASH manifests (bsc#1251137).\n- CVE-2025-7700: Fixed a NULL Pointer Dereference in the ALS Decoder (bsc#1246790)\n- CVE-2024-36618: Fixed a integer overflow in AVI demuxer (bsc#1234020)\n- CVE-2023-6601: Fixed HLS Unsafe File Extension Bypass (bsc#1220545).\n\n- Update to release 4.4.6\n  * lavc/libx265: unbreak build for X265_BUILD \u003e= 210\n  * ARM: vp9mc: Load only 12 pixels in the 4 pixel wide\n    horizontal filter\n  * rtmpproto: Avoid rare crashes in the `fail:` codepath in\n    rtmp_open\n  * avcodec/snow: Fix off by 1 error in run_buffer\n  * avcodec/mpegvideo_enc: Check FLV1 resolution limits\n","status":"published","published":"2026-05-09T08:50:33Z","modified":"2026-05-11T08:15:31.297138Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2025-7700","title":"CVE-2025-7700 in rootio-ffmpeg - Patched by Root","description":"Root has patched CVE-2025-7700 in the rootio-ffmpeg package for Root:Debian:11. Multiple fixed versions available.","status":"withdrawn","published":"2025-09-16T12:57:24Z","modified":"2026-08-23T14:00:13.553307715Z","updated_at":"2026-11-02T15:53:29.631993Z"},{"id":"SUSE-SU-2025:02972-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\n- CVE-2024-36618: Fixed integer overflow iff ULONG_MAX \u003c INT64_MAX (bsc#1234020).\n- CVE-2025-7700: Fixed potential NULL pointer dereference (bsc#1246790).\n","status":"published","published":"2025-08-25T08:46:43Z","modified":"2026-03-23T04:49:49.290575Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02990-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2025-7700: Fixed NULL Pointer Dereference in FFmpeg ALS Decoder (libavcodec/alsdec.c) (bsc#1246790).\n","status":"published","published":"2025-08-27T10:29:08Z","modified":"2026-02-04T03:59:28.109489Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03162-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\n- CVE-2025-7700: Fixed NULL Pointer Dereference in FFmpeg ALS Decoder (bsc#1246790).\n  ","status":"published","published":"2025-09-11T09:16:14Z","modified":"2026-02-04T03:03:35.675026Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:2990-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2025-7700: Fixed NULL Pointer Dereference in FFmpeg ALS Decoder (libavcodec/alsdec.c) (bsc#1246790).\n","status":"published","published":"2025-11-05T09:07:00Z","modified":"2026-03-23T04:51:17.450754Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3715-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\n  - CVE-2025-59728: allocated space for the appended '/' (bsc#1251137)\n  ","status":"published","published":"2025-10-22T07:11:25Z","modified":"2026-02-04T03:45:12.735875Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:20932-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- Updated to version 7.1.2:\n  * avcodec/librsvgdec: fix compilation with librsvg 2.50.3\n  * libavfilter/af_firequalizer: Add check for av_malloc_array()\n  * avcodec/libsvtav1: unbreak build with latest svtav1\n  * avformat/hls: Fix Youtube AAC\n  * Various bugfixes.\n  * CVE-2025-7700: Fixed NULL Pointer Dereference in ALS Decoder (bsc#1246790)\n","status":"published","published":"2026-03-25T09:58:50Z","modified":"2026-04-02T17:24:43.44441Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-7830-1","title":"ffmpeg vulnerabilities","description":"It was discovered that FFmpeg incorrectly handled the return values of\nfunctions in its Firequalizer filter and in the HTTP Live Streaming (HLS)\nimplementation, leading to a NULL pointer dereference. If a user was \ntricked into loading a crafted media file, a remote attacker could \npossibly use this issue to make FFmpeg crash, resulting in a denial\nof service. (CVE-2023-6603, CVE-2025-10256)\n\nIt was discovered that FFmpeg did not enforce an input format before\ntriggering the HTTP demuxer. A remote attacker could possibly use this\nissue to perform a Server-Side Request Forgery (SSRF) attack.\n(CVE-2025-6605)\n\nIt was discovered that FFmpeg incorrectly handled memory allocation in the\nALS audio decoder. If a user was tricked into loading a crafted media file,\na remote attacker could possibly use this issue to make FFmpeg crash,\nresulting in a denial of service. (CVE-2025-7700)\n\nIt was discovered that FFmpeg incorrectly handled memory in the JPEG 2000\ndecoder, which could lead to a heap buffer overflow. If a user or \napplication were tricked into opening a specially crafted file, an \nattacker could possibly use this issue to cause a denial of service \nor leak sensitive information. (CVE-2025-9951)","status":"published","published":"2025-10-21T11:20:52Z","modified":"2026-04-27T18:23:20.840957Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7871-1","title":"ffmpeg vulnerability","description":"It was discovered that FFmpeg incorrectly handled memory allocation in the\nALS audio decoder. If a user was tricked into loading a crafted media file,\na remote attacker could possibly use this issue to make FFmpeg crash,\nresulting in a denial of service.","status":"published","published":"2025-11-16T23:19:59Z","modified":"2026-04-27T18:26:53.002387Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}