There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the
    function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The
    manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The
    exploit has been disclosed to the public and may be used. (CVE-2025-1594)

  - A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via
    improper parsing of non-TTY-compliant input files in HLS playlists. (CVE-2023-6602)

  - A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage
    consumption, potentially leading to degraded performance or denial of service via the demuxing of
    arbitrary data as XBIN-formatted data without proper format validation. (CVE-2023-6604)

  - A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests
    to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
    (CVE-2023-6605)

  - Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within
    an Executable. This vulnerability is associated with program files
    https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C . This issue affects FFmpeg: 7.1. Issue
    was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
    https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered
    by: Simcha Kosman (CVE-2025-0518)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the     height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy     loops at [0] and [1] will continue to write until the next multiple of 8. The buffer td->uncompressed_data     is allocated in decode_block based on the precise height and width of the image, so the rounded-up     multiple of 8 in the copy loop can exceed the buffer bounds, and the write block starting at [2] can     corrupt following heap memory. We recommend upgrading to version 8.0 or beyond. (CVE-2025-59732)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7982-1 advisory.

    It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-59728)

    It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-59731, CVE-2025-59732)

    It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-59733)

    It was discovered that FFmpeg did not correctly handle certain integer arithmetic operations. An attacker     could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-63757)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
436230	Alpine: multiple ffmpeg packages: security update to 8.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	12/4/2025	7/20/2026	high
436230	Alpine: multiple ffmpeg packages: security update to 8.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	12/4/2025	7/20/2026	high
269320	Linux Distros Unpatched Vulnerability : CVE-2025-59732	Nessus	Misc.	10/8/2025	3/20/2026	high
297270	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : FFmpeg vulnerabilities (USN-7982-1)	Nessus	Ubuntu Local Security Checks	1/30/2026	4/30/2026	high

Detections

Analytics

Plugins Search

high

high

high

high