CVE-2025-7700: Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)
A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.
Other sources
NULL Pointer Dereference vulnerability in the ALS audio decoder of the FFmpeg multimedia framework. The flaw lies in the decodeinit() function, where memory allocation results (e.g., larray, nbits, rawmantissa[c]) are not validated before use. If a crafted ALS file causes allocation functions like avmallocarray() or avcalloc() to fail, the code may dereference NULL pointers, leading to application crashes. This issue can be triggered remotely without any authentication, resulting in a denial-of-service scenario for any application using FFmpeg for ALS decoding.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:9.0.2-4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7700?
CVE-2025-7700 is classified as a low severity vulnerability due to its potential to crash the application without leading to data theft or system control.
How do I fix CVE-2025-7700?
To fix CVE-2025-7700, ensure you are using the latest version of FFmpeg, which includes patches for this memory allocation issue.
What is the impact of CVE-2025-7700?
The impact of CVE-2025-7700 is that it can cause applications using FFmpeg to crash when processing certain malformed audio files.
Who is affected by CVE-2025-7700?
CVE-2025-7700 affects all users of FFmpeg who may be processing audio files, especially those with malformed content.
Are there any known exploits for CVE-2025-7700?
As of now, there are no known public exploits for CVE-2025-7700, but the potential for disruption exists when handling malformed audio files.