CVE-2025-22920: FFmpeg Heap Buffer Overflow DoS Vulnerability

CVE-2025-22920 Overview

CVE-2025-22920 is a heap buffer overflow vulnerability in FFmpeg affecting versions prior to commit 4bf784c. The flaw resides in the avformat component and triggers when the library processes tile grid group streams within a crafted media file. An attacker can supply a malicious media file to corrupt heap memory and cause a denial-of-service condition in applications that rely on FFmpeg for media parsing. The weakness is classified as [CWE-122] Heap-based Buffer Overflow.

Critical Impact
Remote attackers can trigger heap memory corruption in FFmpeg by delivering a crafted media file, resulting in denial of service in any service or workflow that ingests untrusted media through the vulnerable avformat code path.

Affected Products

FFmpeg versions prior to commit 4bf784c0e5615c3f934e677d5de093a8be7da7ae
Applications and services embedding vulnerable FFmpeg libavformat builds
Downstream distributions packaging FFmpeg before the fix commit

Discovery Timeline

2025-02-18 - CVE-2025-22920 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22920

Vulnerability Analysis

The vulnerability exists in FFmpeg's libavformat demuxer logic that handles tile grid group streams. When parsing a crafted media file, the affected code path writes beyond the bounds of a heap-allocated buffer. This out-of-bounds write corrupts adjacent heap memory and destabilizes the FFmpeg process. The upstream fix landed in commit 4bf784c0e5615c3f934e677d5de093a8be7da7ae, tracked as FFmpeg Ticket #11389. Because FFmpeg is widely embedded in transcoding pipelines, streaming services, web upload handlers, and desktop media players, any workflow ingesting untrusted media inherits this exposure.

Root Cause

The root cause is insufficient validation of tile grid group stream metadata during demuxing. The code path allocates a heap buffer sized on parsed structural fields without enforcing bounds against actual data written into it. A specifically constructed media file yields values that drive the writer past the allocated region, producing a heap-based buffer overflow classified under [CWE-122].

Attack Vector

Exploitation requires an attacker to deliver a crafted media file to a target that invokes FFmpeg's avformat demuxers. No authentication or user interaction beyond file processing is required. Common delivery paths include media uploads to web applications, automated transcoding pipelines, and client-side playback of attacker-controlled URLs. The confirmed impact is denial of service through memory corruption; broader consequences depend on host allocator behavior and downstream memory usage.

No verified public proof-of-concept code is available. Technical details are described in the upstream FFmpeg Commit Update and the associated FFmpeg Ticket #11389.

Detection Methods for CVE-2025-22920

Indicators of Compromise

Unexpected crashes, aborts, or SIGSEGV signals in processes linking libavformat when handling user-supplied media
Heap corruption diagnostics from allocator hardening (glibc malloc errors, ASan reports) tied to FFmpeg call stacks
Anomalous restarts of transcoding workers or media ingestion services shortly after new file uploads

Detection Strategies

Inventory hosts and containers running FFmpeg builds predating commit 4bf784c using software composition analysis
Enable AddressSanitizer or allocator hardening on non-production FFmpeg workloads to surface out-of-bounds writes during triage
Correlate media upload events with subsequent process crashes in application and container logs

Monitoring Recommendations

Alert on repeated crashes of ffmpeg, ffprobe, or embedding processes handling user-submitted content
Track file hashes of media that cause worker termination and quarantine matching samples across the fleet
Monitor for elevated error rates in demuxing telemetry that references tile grid group stream parsing

How to Mitigate CVE-2025-22920

Immediate Actions Required

Upgrade FFmpeg to a build that includes commit 4bf784c0e5615c3f934e677d5de093a8be7da7ae or later
Rebuild and redeploy any statically linked applications and containers that bundle libavformat
Restrict acceptance of untrusted media sources until patched builds are rolled out to production workloads

Patch Information

The upstream fix is available in the FFmpeg source repository at FFmpeg Commit 4bf784c. Apply the commit directly or update to a distribution package that incorporates it. Verify downstream libraries such as libavformat and libavcodec are rebuilt against the patched sources.

Workarounds

Disable or filter out media formats that exercise tile grid group stream parsing where operationally feasible
Sandbox FFmpeg execution using seccomp, containers, or dedicated low-privilege service accounts to contain crashes
Enforce strict input validation and file-type allowlists on media upload endpoints prior to invoking FFmpeg

bash

# Configuration example: build FFmpeg from the patched commit
git clone https://git.ffmpeg.org/ffmpeg.git
cd ffmpeg
git checkout 4bf784c0e5615c3f934e677d5de093a8be7da7ae
./configure --disable-debug --enable-optimizations
make -j"$(nproc)"
sudo make install
ffmpeg -version