CVE-2025-9951

HighCVSS 7.2/10Last modified Oct 19, 2026

Description

A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.

Metrics

CVSS 4.0 7.2/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2025
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-99526.1The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site CVE-2025-99539.8Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditat CVE-2025-99547.5Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.CVE-2025-99555.7An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on interna CVE-2025-99572.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.CVE-2025-99587.7An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, th CVE-2025-99597.6Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smo CVE-2025-99606.9A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affect CVE-2025-99618.6An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be CVE-2025-996210.0A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affects CVE-2025-99639.4A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. Thi CVE-2025-99648.6No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P