Skip to content

[Security] CVE-2025-22919: AAC decoder assertion failure (unpatched upstream fix) #122

Description

@vulgraph

Summary

This fork is affected by CVE-2025-22919, an assertion failure in the AAC decoder (libavcodec/aacdec.c) that was patched in upstream FFmpeg but has not been applied here.

This report is being filed on behalf of independent security researchers studying vulnerability propagation in FFmpeg forks.

CVE Details

  • CVE: CVE-2025-22919
  • Component: libavcodec/aacdec.c (AAC decoder)
  • Type: Assertion failure (CWE-617) — Denial of Service
  • Trigger: Crafted AAC audio stream

Verification

This fork was built with AddressSanitizer instrumentation in a Docker environment. The AAC decoder aborts when processing the crafted input, confirming the upstream fix has not been applied.

Assertion failed: ...
libavcodec/aacdec.c: ...

Upstream Fix

Please refer to the upstream FFmpeg fix for CVE-2025-22919 and apply the relevant patch to this fork.

Impact

An attacker who can supply a crafted audio file to an application using this fork can trigger a denial of service (process abort).


Reported by: independent security researchers

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions