CVE-2025-22921: FFmpeg Buffer Overflow Vulnerability

CVE-2025-22921 Overview

CVE-2025-22921 is a null pointer dereference vulnerability [CWE-476] in FFmpeg, affecting the JPEG 2000 decoder implemented in /libavcodec/jpeg2000dec.c. The flaw was identified in the git-master build N-113007-g8d24a28d06 and results in a segmentation violation when the decoder processes a malformed JPEG 2000 stream. An attacker can craft a media file that, when opened or transcoded by a vulnerable FFmpeg build, terminates the process. The issue impacts FFmpeg 7.0 through 8.0.1 branches and has been addressed in Debian LTS through backported patches for debian_linux 11.0.

Critical Impact
Remote attackers can trigger a denial-of-service condition against any service or workflow that decodes untrusted JPEG 2000 content with a vulnerable FFmpeg build.

Affected Products

FFmpeg 7.0, 7.0.1, 7.0.2, 7.0.3
FFmpeg 7.1, 7.1.1, 7.1.2, 7.1.3, 7.2 (dev), 8.0, 8.0.1, 8.1 (dev)
Debian Linux 11.0 (LTS)

Discovery Timeline

2025-02-18 - CVE-2025-22921 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22921

Vulnerability Analysis

The vulnerability resides in FFmpeg's JPEG 2000 decoder module libavcodec/jpeg2000dec.c. When the decoder parses a crafted JPEG 2000 bitstream, execution reaches a code path that dereferences a pointer that was never initialized or that was cleared during error recovery. The dereference produces a segmentation violation and terminates the host process.

Because FFmpeg is embedded across media servers, transcoding pipelines, browsers, and desktop players, a single malformed file can disrupt automated processing chains. The CVSS vector indicates that exploitation requires user interaction, such as opening or ingesting the malicious file, but no authentication or privileges on the target. Confidentiality and integrity are not affected, aligning with a denial-of-service outcome.

Root Cause

The root cause is a missing validation check inside the JPEG 2000 decoding routines. Structures that describe tile, component, or codestream state are consumed before the parser confirms they were successfully allocated and populated, allowing a null pointer to reach a dereferencing operation.

Attack Vector

Exploitation is network-adjacent through content delivery. An attacker hosts or transmits a crafted .jp2, .j2k, or container file embedding a JPEG 2000 stream. When a user or automated service processes the file with a vulnerable FFmpeg build, the decoder crashes. The public FFmpeg Ticket #11393 documents the reproducer.

No public exploit binary is required; a malformed sample file is sufficient to reproduce the crash.

Detection Methods for CVE-2025-22921

Indicators of Compromise

Unexpected SIGSEGV termination of ffmpeg, ffprobe, or applications linking libavcodec when handling JPEG 2000 assets.
Core dumps referencing symbols within libavcodec/jpeg2000dec.c.
Repeated processing failures in transcoding queues tied to specific inbound files with .jp2, .j2k, or JPEG 2000 payloads.

Detection Strategies

Inventory FFmpeg versions across servers, containers, and workstations and flag builds in the 7.0-8.0.1 range that lack distribution patches.
Monitor process crash telemetry for ffmpeg and dependent services, correlating with recently ingested media files.
Scan media ingestion pipelines for JPEG 2000 files that fail decoding, and quarantine them for analysis.

Monitoring Recommendations

Enable core dump capture and centralized crash reporting on media workers to spot repeated decoder failures.
Alert on abnormal restart loops of transcoding containers or systemd services wrapping FFmpeg.
Log SHA-256 hashes of inbound media so recurring malicious samples can be tracked across the environment.

How to Mitigate CVE-2025-22921

Immediate Actions Required

Upgrade FFmpeg to a fixed build supplied by your distribution or from the FFmpeg project's patched git-master.
Apply the Debian LTS update referenced in the Debian LTS Announcement for Debian 11 systems.
Restrict ingestion of untrusted JPEG 2000 content until patched builds are deployed to all decoding hosts.

Patch Information

The FFmpeg project tracks the fix in FFmpeg Ticket #11393. Debian released a backported package through its LTS channel, and downstream distributions have rebuilt their FFmpeg binaries accordingly. Rebuild any statically linked applications that bundle libavcodec to pick up the corrected decoder.

Workarounds

Disable the JPEG 2000 decoder at build time or via runtime configuration if the format is not required.
Route JPEG 2000 processing through a sandboxed worker with automatic restart and resource limits to contain crashes.
Filter inbound media at the perimeter to block or scrub JPEG 2000 payloads from untrusted sources.

bash

# Configuration example: build FFmpeg without JPEG 2000 support
./configure \
    --disable-decoder=jpeg2000 \
    --disable-encoder=jpeg2000 \
    --disable-demuxer=jpeg2000 \
    --disable-parser=jpeg2000
make && sudo make install