Search for vulnerabilities
Vulnerability details: VCID-fv2s-79bs-rkb9
Vulnerability ID VCID-fv2s-79bs-rkb9
Aliases CVE-2025-0518
Summary Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C . This issue affects FFmpeg: 7.1. Issue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-125 Out-of-bounds Read
CWE-252 Unchecked Return Value
System Score Found at
epss 0.00071 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00071 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00071 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00071 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00071 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00071 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0518
cvssv3.1 4.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv4 4.8 https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
ssvc Track https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-0518
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-0518
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0518
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
b5b6391d64807578ab872dc58fb8aa621dcfc38a https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
cpe:2.3:a:ffmpeg:ffmpeg:7.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ffmpeg:ffmpeg:7.1:*:*:*:*:*:*:*
CVE-2025-0518 https://nvd.nist.gov/vuln/detail/CVE-2025-0518
USN-7538-1 https://usn.ubuntu.com/7538-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-16T19:10:53Z/ Found at https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-0518
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.22133
EPSS Score 0.00071
Published At Aug. 6, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:54:34.752120+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/7538-1/ 37.0.0