CVE-2025-9951
NoneCVSS
—
EPSS
0.4%
Published
Sep 9, 2025
CISA due date
—
Cloudanix analysis
A bug in the part of the software that reads certain image files could let someone who sends a specially made image take control of the system or make it stop working.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- High
- Impact
- Remote Code Execution
- Component
- Library
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Medium
What it actually does
Heap buffer overflow write in jpeg2000dec decoder triggered by malformed channel definition cdef atom in JPEG2000 streams, enabling memory corruption that can lead to remote code execution or denial of service.
Why it matters to the business
Systems processing untrusted JPEG2000 content face risk of remote compromise or service outages; low exploit probability and absence from known campaigns reduce immediate urgency, though widespread media-handling dependencies amplify exposure across affected packages.
How an attack unfolds
An attacker crafts a JPEG2000 file containing a malicious cdef atom sized to overflow the decoder heap buffer, then delivers it to a vulnerable FFmpeg-based parser in OpenSearch components; successful overflow allows arbitrary code execution or crash without authentication.
How to fix it
Upgrade all listed packages to version 2.19.4-r0 or later; rebuild any dependent containers or images incorporating the updated FFmpeg jpeg2000dec decoder; validate removal of vulnerable code paths post-upgrade.
How to confirm the fix worked
Confirm installed package versions match or exceed the listed fixed releases; test decoding of known-good and edge-case JPEG2000 files; monitor for absence of overflow indicators in media processing logs.
Typical attack path
- Identify target service accepting JPEG2000 input
- Craft malicious file with oversized or malformed cdef atom
- Deliver file via network upload, API call, or storage ingestion
- Trigger decoding path in jpeg2000dec
- Achieve memory corruption leading to RCE or DoS
How to detect it
Inspect media ingestion logs for JPEG2000 files triggering decoder errors or crashes; correlate with process crashes in FFmpeg-related components; review file upload or storage access patterns around the time of any anomalous decoder activity.
What your security team should do
- Prioritize patching the seven affected MinimOS packages to 2.19.4-r0 within standard change windows given low EPSS
- Restrict untrusted JPEG2000 ingestion until patches are applied
- Add media file type validation and sandboxing for image processing pipelines
- Review downstream dependents for transitive exposure
The record
A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | ffmpeg-6 | 0 | 6.1.4-r0 |
| Chainguard | ffmpeg-6-dev | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-doc | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-libavcodec61 | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-libavdevice61 | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-libavfilter10 | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-libavformat61 | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-libavutil59 | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-libpostproc58 | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-libswresample5 | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-libswscale8 | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-qt-faststart | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-6-static | 0 | 6.1.3-r0 |
| Chainguard | ffmpeg-7 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-dev | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-doc | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-libavcodec61 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-libavdevice61 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-libavfilter10 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-libavformat61 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-libavutil59 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-libpostproc58 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-libswresample5 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-libswscale8 | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-qt-faststart | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7-static | 0 | 7.1.1-r11 |
| Chainguard | ffmpeg-7.1 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-dev | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-doc | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavcodec61 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavdevice61 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavfilter10 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavformat61 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavutil59 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libpostproc58 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libswresample5 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libswscale8 | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-qt-faststart | 0 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-static | 0 | 7.1.2-r0 |
| Debian:11 | ffmpeg | 0 | No fix |
| Debian:12 | ffmpeg | 0 | No fix |
| Debian:13 | ffmpeg | 0 | No fix |
| Debian:14 | ffmpeg | 0 | No fix |
| Wolfi | ffmpeg-7 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-dev | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-doc | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-libavcodec61 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-libavdevice61 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-libavfilter10 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-libavformat61 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-libavutil59 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-libpostproc58 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-libswresample5 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-libswscale8 | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-qt-faststart | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7-static | 0 | 7.1.1-r11 |
| Wolfi | ffmpeg-7.1 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-dev | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-doc | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavcodec61 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavdevice61 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavfilter10 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavformat61 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavutil59 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libpostproc58 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libswresample5 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libswscale8 | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-qt-faststart | 0 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-static | 0 | 7.1.2-r0 |
| openSUSE:Leap 16.0 | ffmpeg-7 | 0 | 7.1.4-160000.1.1 |
| openSUSE:Tumbleweed | ffmpeg-4 | 0 | 4.4.7-2.1 |
| openSUSE:Tumbleweed | ffmpeg-7 | 0 | 7.1.4-2.1 |
| openSUSE:Tumbleweed | ffmpeg-8 | 0 | 8.1.1-3.1 |
Related vulnerabilities
- CVE-2025-22919 A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers… Also affects ffmpeg-6
- CVE-2025-0518 Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive… Also affects ffmpeg-6
- CVE-2023-51794 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to… Also affects ffmpeg-6
- CVE-2023-51793 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to… Also affects ffmpeg-6
- CVE-2023-51796 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to… Also affects ffmpeg-6
- CVE-2023-51798 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to… Also affects ffmpeg-6
- CVE-2023-51791 Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to… Also affects ffmpeg-6
- CVE-2023-51795 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to… Also affects ffmpeg-6