What’s Vulnerable › Vulnerabilities

CVE-2025-9951: Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000

• Severity: high (CVSS 7.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-09 · updated 2026-10-19
• Weakness: CWE-122

Description

A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.

Affected products

• FFmpeg: before 8.0

References

• https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg

Get alerted when CVE-2025-9951 or the next vulnerability affects your stack