CVE-2025-22919

What it actually does

A reachable assertion in FFmpeg's AAC decoder triggers an abort when processing a specially crafted input file, causing the process to terminate.

Why it matters to the business

Applications that parse user-supplied or untrusted AAC content can be forced offline, interrupting media workflows and requiring manual restarts until the vulnerable code is replaced.

How an attack unfolds

An attacker creates a malformed AAC file that reaches an assertion in the decoder, then delivers the file to a target application or service that uses the vulnerable FFmpeg build; opening or processing the file immediately crashes the process.

How to fix it

Upgrade the affected openthread (OSS-Fuzz) component to commit a3548df579617e737b075be4a88591e68195e115 or later; rebuild any dependent FFmpeg integrations with the patched code.

How to confirm the fix worked

Confirm the running binary or library reports the patched commit hash; test with known-good and known-bad AAC samples to verify the assertion no longer triggers.

Typical attack path

1. Craft a minimal AAC file that exercises the reachable assertion path
2. Deliver the file to the victim via download, upload, email attachment, or media ingestion pipeline
3. Induce the target application to open or decode the file
4. Observe process termination and service unavailability

How to detect it

Search application and system logs for abrupt terminations or assertion failures immediately after AAC file processing; correlate with file upload or playback events.

What your security team should do

• Prioritize patching any media-processing services that ingest untrusted AAC within the next maintenance window
• Add the fixed commit to dependency scanners and CI pipelines
• Review logs for unexpected process crashes correlated with AAC file handling