CVE-2025-9951

HighCVSS 7.2/10Last modified Oct 19, 2026

Description

A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.

Metrics

CVSS 4.0 7.2/10CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-122

Affected software

VendorProductVersions
FFmpegFFmpeg< 8.0

References

Timeline

Published
Sep 9, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-99526.1The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site CVE-2025-99539.8Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank AccreditatCVE-2025-99547.5Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.CVE-2025-99555.7An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internaCVE-2025-99572.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.CVE-2025-99587.7An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, thCVE-2025-99597.6Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smoCVE-2025-99606.9A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affectCVE-2025-99618.6An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500.  The exploit can only be CVE-2025-996210.0A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affectsCVE-2025-99639.4A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. ThiCVE-2025-99648.6No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P