Summary
This fork is affected by CVE-2025-22919, an assertion failure in the AAC decoder (libavcodec/aacdec.c) that was patched in upstream FFmpeg but has not been applied here.
This report is being filed on behalf of independent security researchers studying vulnerability propagation in FFmpeg forks.
CVE Details
- CVE: CVE-2025-22919
- Component:
libavcodec/aacdec.c (AAC decoder)
- Type: Assertion failure (CWE-617) — Denial of Service
- Trigger: Crafted AAC audio stream
Verification
This fork was built with AddressSanitizer instrumentation in a Docker environment. The AAC decoder aborts when processing the crafted input, confirming the upstream fix has not been applied.
Assertion failed: ...
libavcodec/aacdec.c: ...
Upstream Fix
Please refer to the upstream FFmpeg fix for CVE-2025-22919 and apply the relevant patch to this fork.
Impact
An attacker who can supply a crafted audio file to an application using this fork can trigger a denial of service (process abort).
Reported by: independent security researchers
Summary
This fork is affected by CVE-2025-22919, an assertion failure in the AAC decoder (
libavcodec/aacdec.c) that was patched in upstream FFmpeg but has not been applied here.This report is being filed on behalf of independent security researchers studying vulnerability propagation in FFmpeg forks.
CVE Details
libavcodec/aacdec.c(AAC decoder)Verification
This fork was built with AddressSanitizer instrumentation in a Docker environment. The AAC decoder aborts when processing the crafted input, confirming the upstream fix has not been applied.
Upstream Fix
Please refer to the upstream FFmpeg fix for CVE-2025-22919 and apply the relevant patch to this fork.
Impact
An attacker who can supply a crafted audio file to an application using this fork can trigger a denial of service (process abort).
Reported by: independent security researchers