Skip to content
OpenAdvisories
Medium USN-7738-1 1 CVE

ffmpeg vulnerability

Published Sep 4, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that FFmpeg incorrectly handled the calculation of
LPC order, which could lead to a stack-based buffer overflow. An attacker
could possibly use this issue to cause FFmpeg to crash, resulting in a
denial of service.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ffmpeg 7:2.8.17-0ubuntu0.1+esm11
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ffmpeg 7:3.4.11-0ubuntu0.1+esm9
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS ffmpeg 7:4.2.7-0ubuntu0.1+esm9
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS ffmpeg 7:4.4.2-0ubuntu0.22.04.1+esm8
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS ffmpeg 7:6.1.1-3ubuntu5+esm4

Vulnerabilities 1

  • Medium 6.3
    CVE-2025-1594

    FFmpeg AAC Encoder aacenc_tns.c ff_aac_search_for_tns stack-based overflow

    A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is po…

    ffmpeg ffmpeg ffmpeg ffmpeg-7 Debian Ubuntu Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2025-1594