CVE-2025-69693 Details
Description
Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The quantization parameter (qp) validation at line 2267 only checks the lower bound (qp < 0) but is missing upper bound validation. The qp value can reach 65 (base value 63 from 6-bit frame header + offset +2 from read_qp_offset) while the rv60_qp_to_idx array has size 64 (valid indices 0-63). This results in out-of-bounds array access at lines 1554 (decode_cbp8), 1655 (decode_cbp16), and 1419/1421 (get_c4x4_set), potentially leading to memory disclosure or crash. A previous fix in commit 61cbcaf93f added validation only for intra frames. This vulnerability affects the released versions 8.0 (released 2025-08-22) and 8.0.1 (released 2025-11-20) and is fixed in git master commit 8abeb879df which will be included in FFmpeg 8.1.
A vulnerability allowing out-of-bounds read has been identified in the FFmpeg RV60 video decoder, specifically in versions 8.0 and 8.0.1. The issue arises from insufficient validation of the quantization parameter (qp) in the decoder. While the lower bound is checked, the upper bound validation is missing, allowing qp values to exceed the valid range and access memory out of bounds. This flaw could lead to memory disclosure or a crash.
Users can upgrade to FFmpeg version 8.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFmpeg/FFmpeg/commit/8abeb879df66ea8d27ce1735925ced5a30813de4 | [email protected] | Patch |
| https://github.com/FFmpeg/FFmpeg/releases/tag/n8.0 | [email protected] | ProductRelease Notes |
| https://github.com/FFmpeg/FFmpeg/releases/tag/n8.0.1 | [email protected] | ProductRelease Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| ffmpeg ffmpeg | 8.0 8.0.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 16, 2026 | CVE Modified | CISA-ADP |
| Mar 16, 2026 | New CVE Received | [email protected] |