CVE-2025-9951

NameCVE-2025-9951
DescriptionA heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5985-1, DSA-6007-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)bullseye7:4.3.7-0+deb11u1vulnerable
bullseye (security)7:4.3.9-0+deb11u1vulnerable
bookworm7:5.1.7-0+deb12u1fixed
bookworm (security)7:5.1.8-0+deb12u1fixed
trixie7:7.1.2-0+deb13u1fixed
trixie (security)7:7.1.3-0+deb13u1fixed
forky, sid7:8.0.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsourcebookworm7:5.1.7-0+deb12u1DSA-5985-1
ffmpegsourcetrixie7:7.1.2-0+deb13u1DSA-6007-1
ffmpegsource(unstable)7:7.1.2-1

Notes

[bullseye] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 4.3 branch)
https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg
https://github.com/FFmpeg/FFmpeg/commit/01a292c7e36545ddeb3c7f79cd02e2611cd37d73 (n8.0)
https://github.com/FFmpeg/FFmpeg/commit/d141e864f73152e94e0c45cc4abb8c329275c265 (n7.1.2)
https://github.com/FFmpeg/FFmpeg/commit/1f03c050e4e37f96968d1ffa4d720ed20810fdf6 (n5.1.7)

Search for package or bug name: Reporting problems