CVE-2025-9951

HIGH

FFmpeg < 8.0 - Heap-based Buffer Overflow via JPEG2000 Channel Definition Atom

Title source: llm
STIX 2.1

Description

A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.

References (1)

Core 1

Scores

CVSS v4 7.2
EPSS 0.0037
EPSS Percentile 28.9%
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-122
Status published
Products (1)
FFmpeg/FFmpeg < 8.0
Published Sep 09, 2025
Tracked Since Feb 18, 2026