CVE-2025-1816

FFmpeg IAMF File iamf_parse.c audio_element_obu memory leak

State: Published
Severity: 5.3 Medium
Published: Mar 2, 2025
Updated: Mar 3, 2025
Reserved: Mar 1, 2025

Description

A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:N/A:P	VulDB

Weaknesses

CWE-401 Memory Leak
CWE-404 Denial of Service

Affected Products

Product	Versions
FFmpegn/a	6e26f57f672b05e7b8b052007a83aef99dc81ccbAffected

References

VDB-298089 | FFmpeg IAMF File iamf_parse.c audio_element_obu memory leakvdb-entrytechnical-description
VDB-298089 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #506575 | FFmpeg git master Memory Leakthird-party-advisory
https://trac.ffmpeg.org/ticket/11475issue-tracking
https://trac.ffmpeg.org/attachment/ticket/11475/pocexploitissue-tracking
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0526535cd58444dd264e810b2f3348b4d96cff3bpatch
https://ffmpeg.org/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.