CVE-2025-7700

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7700", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-07-16T05:12:48.951Z", "datePublished": "2025-11-07T18:59:28.962Z", "dateUpdated": "2026-05-06T14:38:29.969Z"}, "containers": {"cna": {"title": "Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg\u2019s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "8.0", "versionType": "semver"}], "packageName": "ffmpeg", "collectionURL": "https://github.com/FFmpeg/FFmpeg/", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-7700", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380420", "name": "RHBZ#2380420", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"}], "datePublic": "2025-07-15T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-476: NULL Pointer Dereference", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Users are strongly encouraged to apply vendor-supplied updates or patches as they become available to address this vulnerability."}], "timeline": [{"lang": "en", "time": "2025-07-16T04:55:06.900Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-07-15T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Jiasheng Jiang for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-05-06T14:38:29.969Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-07T19:07:55.825409Z", "id": "CVE-2025-7700", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-07T19:08:06.222Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7700", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-07T19:07:55.825409Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-07T19:08:01.227Z"}}], "cna": {"title": "Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)", "credits": [{"lang": "en", "value": "Red Hat would like to thank Jiasheng Jiang for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "8.0", "versionType": "semver"}], "packageName": "ffmpeg", "collectionURL": "https://github.com/FFmpeg/FFmpeg/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-16T04:55:06.900Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-07-15T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-07-15T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-7700", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380420", "name": "RHBZ#2380420", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Users are strongly encouraged to apply vendor-supplied updates or patches as they become available to address this vulnerability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg\u2019s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-05-06T14:38:29.969Z"}, "x_redhatCweChain": "CWE-476: NULL Pointer Dereference"}}, "cveMetadata": {"cveId": "CVE-2025-7700", "state": "PUBLISHED", "dateUpdated": "2026-05-06T14:38:29.969Z", "dateReserved": "2025-07-16T05:12:48.951Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-11-07T18:59:28.962Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/FFmpeg/FFmpeg/", "defaultStatus": "unaffected", "packageName": "ffmpeg", "versions": [{"lessThan": "8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg\u2019s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en el decodificador de audio ALS de FFmpeg, donde no verifica adecuadamente las fallas de asignaci\u00f3n de memoria. Esto puede causar que la aplicaci\u00f3n falle al procesar ciertos archivos de audio malformados. Si bien no conduce al robo de datos o al control del sistema, puede ser utilizado para interrumpir servicios y causar una denegaci\u00f3n de servicio."}], "id": "CVE-2025-7700", "lastModified": "2026-11-05T14:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7700", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-07T19:07:55.825409Z", "version": "2.0.3"}}]}, "published": "2025-11-07T19:16:27.923", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2025-7700"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380420"}, {"source": "secalert@redhat.com", "url": "https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Jiasheng Jiang for reporting this issue.", "bugzilla": {"description": "FFmpeg: NULL Pointer Dereference in FFmpeg ALS Decoder (libavcodec/alsdec.c)", "id": "2380420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380420"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-476", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Users are strongly encouraged to apply vendor-supplied updates or patches as they become available to address this vulnerability."}, "name": "CVE-2025-7700", "public_date": "2025-07-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-7700"], "statement": "The Red Hat Product Security team has assessed this vulnerability as Medium severity. It can be exploited remotely without authentication but requires user interaction (e.g., opening a crafted ALS file). While it does not allow code execution or compromise system confidentiality or integrity, it does cause an application crash, posing a moderate availability risk. The root cause is insufficient validation of memory allocation return values in the ALS decoder initialization function.", "threat_severity": "Moderate"}

{"created": "2025-11-10T09:33:44.763803+00:00", "updated": "2025-11-10T09:33:44.763828+00:00", "vendors": ["ffmpeg", "ffmpeg$PRODUCT$ffmpeg"]}