CVE-2025-9951: Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000

Published Sep 9, 2025

Updated

A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.

Affected Software

2 affected componentsFixes available

FFmpeg FFmpeg

debian/ffmpeg

7:5.1.9-0+deb12u17:7.1.5-0+deb13u17:9.0.2-4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:9.0.2-4

Event History

Sep 9, 2025

CVE Published

via MITRE·01:54 PM

Data Sourced

via MITRE·01:54 PM

DescriptionWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4440-1

Frequently Asked Questions

What is the severity of CVE-2025-9951?

CVE-2025-9951 is classified as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2025-9951?

To mitigate CVE-2025-9951, update FFmpeg to the latest version that addresses this vulnerability.

What kind of attacks can exploit CVE-2025-9951?

CVE-2025-9951 can be exploited to achieve remote code execution or cause a denial of service.

Which software is affected by CVE-2025-9951?

CVE-2025-9951 affects the FFmpeg software, specifically its jpeg2000dec component.

What is a heap-buffer-overflow as related to CVE-2025-9951?

A heap-buffer-overflow in CVE-2025-9951 allows for writing outside the allocated memory space, leading to potential security risks.