Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C . This issue affects FFmpeg: 7.1. Issue was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20710-1 advisory.

    Changes in ffmpeg-4:

    - CVE-2025-59728: Fixed out-of-bounds NUL-byte write when calculating the content path in handling of     MPEG-DASH manifests (bsc#1251137).
    - CVE-2025-7700: Fixed a NULL Pointer Dereference in the ALS Decoder (bsc#1246790)
    - CVE-2024-36618: Fixed a integer overflow in AVI demuxer (bsc#1234020)
    - CVE-2023-6601: Fixed HLS Unsafe File Extension Bypass (bsc#1220545).

    - Update to release 4.4.6
      * lavc/libx265: unbreak build for X265_BUILD >= 210
      * ARM: vp9mc: Load only 12 pixels in the 4 pixel wide         horizontal filter
      * rtmpproto: Avoid rare crashes in the `fail:` codepath in         rtmp_open
      * avcodec/snow: Fix off by 1 error in run_buffer
      * avcodec/mpegvideo_enc: Check FLV1 resolution limits

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the
    function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The
    manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The
    exploit has been disclosed to the public and may be used. (CVE-2025-1594)

  - A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via
    improper parsing of non-TTY-compliant input files in HLS playlists. (CVE-2023-6602)

  - A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage
    consumption, potentially leading to degraded performance or denial of service via the demuxing of
    arbitrary data as XBIN-formatted data without proper format validation. (CVE-2023-6604)

  - A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests
    to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
    (CVE-2023-6605)

  - Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within
    an Executable. This vulnerability is associated with program files
    https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C . This issue affects FFmpeg: 7.1. Issue
    was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
    https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered
    by: Simcha Kosman (CVE-2025-0518)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the
    function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The
    manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The
    exploit has been disclosed to the public and may be used. (CVE-2025-1594)

  - A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via
    improper parsing of non-TTY-compliant input files in HLS playlists. (CVE-2023-6602)

  - A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage
    consumption, potentially leading to degraded performance or denial of service via the demuxing of
    arbitrary data as XBIN-formatted data without proper format validation. (CVE-2023-6604)

  - A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests
    to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
    (CVE-2023-6605)

  - Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary
    code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
    (CVE-2023-49501)

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5985 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5985-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 25, 2025                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ffmpeg     CVE ID         : CVE-2023-49502 CVE-2023-50007 CVE-2023-50008                      CVE-2024-31582 CVE-2024-35367 CVE-2024-35368                      CVE-2025-0518 CVE-2025-7700 CVE-2025-22919

    Several vulnerabilities have been discovered in the FFmpeg multimedia     framework, which could result in denial of service or potentially the     execution of arbitrary code if malformed files/streams are processed.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 7:5.1.7-0+deb12u1.

    We recommend that you upgrade your ffmpeg packages.

    For the detailed security status of ffmpeg please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ffmpeg

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within     an Executable. This vulnerability is associated with program files     https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C . This issue affects FFmpeg: 7.1. Issue     was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a     https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered     by: Simcha Kosman (CVE-2025-0518)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0093 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-0518:
    Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within     an Executable. This vulnerability is associated with program files     https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .

    This issue affects FFmpeg: 7.1.

    Issue was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a

     https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was     discovered by: Simcha Kosman

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7538-1 advisory.

    Simcha Kosman discovered that FFmpeg did not correctly handle certain return values. An attacker could     possibly use this issue to leak sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu     18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-0518)

    It was discovered that FFmpeg did not correctly handle certain memory operations. A remote attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 24.10. (CVE-2025-1816)

    It was discovered that FFmpeg contained a reachable assertion, which could lead to a failure when     processing certain AAC files. If a user or automated system were tricked into opening a specially crafted     AAC file, an attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.
    (CVE-2025-22919)

    It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu     24.04 LTS, Ubuntu 24.10 and Ubuntu 25.04. (CVE-2025-22921)

    It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 24.04 LTS, Ubuntu 24.10 and Ubuntu 25.04. (CVE-2025-25473)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ffmpeg installed on the remote host is prior to 4.4.6. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-143-01 advisory.

    New ffmpeg packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the ffmpeg security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1450-1 advisory.

    - CVE-2025-22921: Clear array length when freeing it. (bsc#1237382)
    - CVE-2025-0518: Fix memory data leak when use sscanf(). (bsc#1236007)
    - CVE-2025-22919: Check for valid sample rate, to fix the invalid sample rate >= 0. (bsc#1237371)
    - CVE-2024-12361: Add check for av_packet_new_side_data() to avoid null pointer dereference if allocation     fails. (bsc#1237358)
    - CVE-2024-36613: Adjust order of operations around block align. (bsc#1235092)
    - CVE-2024-35365: Fix double-free on error. (bsc#1235091)
    - CVE-2024-35368: Fix double-free on the AVFrame is unreferenced. (bsc#1234028)
    - CVE-2023-51793: Fix out of array access. (bsc#1223272).
    - CVE-2023-51793: Fixed a heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c     (bsc#1223272).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1128-1 advisory.

    - CVE-2020-22037: Fixed unchecked return value of the init_vlc function (bsc#1186756)
    - CVE-2024-12361: Fixed null pointer dereference (bsc#1237358)
    - CVE-2024-35368: Fixed double free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c     (bsc#1234028)
    - CVE-2024-36613: Fixed integer overflow in the DXA demuxer of the libavformat library (bsc#1235092)
    - CVE-2025-0518: Fixed memory leak due to unchecked sscanf return value (bsc#1236007)
    - CVE-2025-22919: Fixed denial of service (DoS) via opening a crafted AAC file (bsc#1237371)
    - CVE-2025-22921: Fixed segmentation violation in NULL pointer dereference via the component     /libavcodec/jpeg2000dec.c (bsc#1237382)
    - CVE-2025-25473: Fixed memory leak in avformat_free_context() (bsc#1237351)

    Other fixes:

    - Build with SVT-AV1 3.0.0.

    - Update to release 4.4.5:
    * Adjust bconds to build the package in SLFO without xvidcore.
    * Add 0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch (bsc#1229338)
    * Add ffmpeg-c99.patch so that the package conforms to the C99 standard and builds on i586 with GCC 14.
    * No longer build against libmfx; build against libvpl (bsc#1230983, bsc#1219494)
    * Drop libmfx dependency from our product (jira #PED-10024)
    * Update patch to build with glslang 14
    * Disable vmaf integration as ffmpeg-4 cannot handle vmaf>=3
    * Copy codec list from ffmpeg-6
    * Resolve build failure with binutils >= 2.41. (bsc#1215945)

    - Update to version 4.4.4:
      * avcodec/012v: Order operations for odd size handling
      * avcodec/alsdec: The minimal block is at least 7 bits
      * avcodec/bink:
        - Avoid undefined out of array end pointers in           binkb_decode_plane()
        - Fix off by 1 error in ref end
      * avcodec/eac3dec: avoid float noise in fixed mode addition to         overflow
      * avcodec/eatgq: : Check index increments in tgq_decode_block()
      * avcodec/escape124:
        - Fix signdness of end of input check
        - Fix some return codes
      * avcodec/ffv1dec:
        - Check that num h/v slices is supported
        - Fail earlier if prior context is corrupted
        - Restructure slice coordinate reading a bit
      * avcodec/mjpegenc: take into account component count when         writing the SOF header size
      * avcodec/mlpdec: Check max matrix instead of max channel in         noise check
      * avcodec/motionpixels: Mask pixels to valid values
      * avcodec/mpeg12dec: Check input size
      * avcodec/nvenc:
        - Fix b-frame DTS behavior with fractional framerates
        - Fix vbv buffer size in cq mode
      * avcodec/pictordec: Remove mid exit branch
      * avcodec/pngdec: Check deloco index more exactly
      * avcodec/rpzaenc: stop accessing out of bounds frame
      * avcodec/scpr3: Check bx
      * avcodec/scpr: Test bx before use
      * avcodec/snowenc: Fix visual weight calculation
      * avcodec/speedhq: Check buf_size to be big enough for DC
      * avcodec/sunrast: Fix maplength check
      * avcodec/tests/snowenc:
        - Fix 2nd test
        - Return a failure if DWT/IDWT mismatches
        - Unbreak DWT tests
      * avcodec/tiff: Ignore tile_count
      * avcodec/utils:
        - Allocate a line more for VC1 and WMV3
        - Ensure linesize for SVQ3
        - Use 32pixel alignment for bink
      * avcodec/videodsp_template: Adjust pointers to avoid undefined         pointer things
      * avcodec/vp3: Add missing check for av_malloc
      * avcodec/wavpack:
        - Avoid undefined shift in get_tail()
        - Check for end of input in wv_unpack_dsd_high()
      * avcodec/xpmdec: Check size before allocation to avoid         truncation
      * avfilter/vf_untile: swap the chroma shift values used for plane         offsets
      * avformat/id3v2: Check taglen in read_uslt()
      * avformat/mov: Check samplesize and offset to avoid integer         overflow
      * avformat/mxfdec: Use 64bit in remainder
      * avformat/nutdec: Add check for avformat_new_stream
      * avformat/replaygain: avoid undefined / negative abs
      * swscale/input: Use more unsigned intermediates
      * swscale/output: Bias 16bps output calculations to improve non         overflowing range
      * swscale: aarch64: Fix yuv2rgb with negative stride
      * Use https for repository links

    - Update to version 4.4.3:
      * Stable bug fix release, mainly codecs, filter and format fixes.

    - Add patch to detect SDL2 >= 2.1.0 (bsc#1202848):

    - Update to version 4.4.2:
      * Stable bug fix release, mainly codecs, filter and format fixes.

    - Add conflicts for ffmpeg-5's tools
    - Enable Vulkan filters
    - Fix OS version check, so nvcodec is enabled for Leap too.
    - Disamble libsmbclient usage (can always be built with
      --with-smbclient): the usecase of ffmpeg directly accessing       smb:// shares is quite constructed (most users will have their       smb shares mounted).

    - Update to version 4.4.1:
      * Stable bug fix release, mainly codecs and format fixes.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0862-1 advisory.

    - CVE-2025-22921: Fixed segmentation violation in NULL pointer dereference via the component     /libavcodec/jpeg2000dec.c (bsc#1237382).
    - CVE-2025-25473: Fixed memory leak in avformat_free_context() (bsc#1237351).
    - CVE-2025-0518: Fixed unchecked sscanf return value which leads to memory data leak (bsc#1236007).
    - CVE-2025-22919: Fixed denial of service (DoS) via opening a crafted AAC file (bsc#1237371).
    - CVE-2024-12361: Fixed NULL Pointer Dereference (bsc#1237358).
    - CVE-2024-35368: Fixed Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c     (bsc#1234028).
    - CVE-2024-36613: Fixed Integer overflow in ffmpeg (bsc#1235092).
    - CVE-2023-50010: Fixed arbitrary code execution via the set_encoder_id function in /fftools/ffmpeg_enc.c     component (bsc#1223256).
    - CVE-2023-51794: Fixed heap-buffer-overflow at libavfilter/af_stereowiden.c (bsc#1223437).
    - CVE-2023-51793: Fixed heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c     (bsc#1223272).
    - CVE-2023-49502: Fixed heap buffer overflow via the ff_bwdif_filter_intra_c function in     libavfilter/bwdifdsp.c (bsc#1223235).
    - CVE-2023-51798: Fixed floating point exception(FPE) via the interpolate function in     libavfilter/vf_minterpolate.c (bsc#1223304).
    - CVE-2024-31578: Fixed heap use-after-free via the av_hwframe_ctx_init function (bsc#1223070).
    - CVE-2024-7055: Fixed heap-based buffer overflow in pnmdec.c (bsc#1229026).
    - CVE-2024-32230: Fixed buffer overflow due to negative-size-param bug at libavcodec/mpegvideo_enc.c in     load_input_picture (bsc#1227296).

    Other fixes:
    - Updated to version 4.4.5.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4073 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4073-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     March 01, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ffmpeg     Version        : 7:4.3.8-0+deb11u3     CVE ID         : CVE-2025-0518 CVE-2025-22919 CVE-2025-22921


    Several issues have been found in ffmpeg, a package of tools for     transcoding, streaming and playing of multimedia files.
    The issues are related to out-of-bounds read, assert errors and NULL     pointer dereferences.


    For Debian 11 bullseye, these problems have been fixed in version     7:4.3.8-0+deb11u3.

    We recommend that you upgrade your ffmpeg packages.

    For the detailed security status of ffmpeg please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ffmpeg

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FFmpeg installed on the remote host is 7.1 prior to 7.2. It is, therefore, affected by a vulnerability:

  - Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an     executable. (CVE-2025-0518)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
313747	openSUSE 16 Security Update : ffmpeg-4 (openSUSE-SU-2026:20710-1)	Nessus	SuSE Local Security Checks	high
436230	Alpine: multiple ffmpeg packages: security update to 8.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
436230	Alpine: multiple ffmpeg packages: security update to 8.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
436215	Alpine: multiple ffmpeg packages: security update to 7.1.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
436215	Alpine: multiple ffmpeg packages: security update to 7.1.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
255189	Debian dsa-5985 : ffmpeg - security update	Nessus	Debian Local Security Checks	medium
253417	Linux Distros Unpatched Vulnerability : CVE-2025-0518	Nessus	Misc.	medium
239869	TencentOS Server 4: ffmpeg (TSSA-2025:0093)	Nessus	Tencent Local Security Checks	medium
237485	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : FFmpeg vulnerabilities (USN-7538-1)	Nessus	Ubuntu Local Security Checks	medium
237224	Slackware Linux 15.0 ffmpeg Multiple Vulnerabilities (SSA:2025-143-01)	Nessus	Slackware Local Security Checks	medium
235182	SUSE SLED15: ffmpeg / ffmpeg-private-devel / libavcodec-devel / libavcodec57 / etc (SUSE-SU-2025:1450-1)	Nessus	SuSE Local Security Checks	medium
233840	SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2025:1128-1)	Nessus	SuSE Local Security Checks	medium
232751	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ffmpeg-4 (SUSE-SU-2025:0862-1)	Nessus	SuSE Local Security Checks	medium
216945	Debian dla-4073 : ffmpeg - security update	Nessus	Debian Local Security Checks	medium
216260	FFmpeg < 7.2 Out-of-bounds Read	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-0518

medium

Tenable Plugins

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium