CVE-2020-22025: 
Ffmpeg vulnerability analysis and mitigation

A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c in FFmpeg, which might lead to memory corruption and other potential consequences. The vulnerability was assigned CVE-2020-22025 and affects FFmpeg versions including 4.2. The issue was discovered in 2020 and patches were released through various distributions in 2021 (Debian LTS, Debian Security).

The vulnerability is a heap-based buffer overflow that occurs in the gaussian_blur function within libavfilter/vf_edgedetect.c at line 153. When processing video with the edgedetect filter, the function performs a memory copy operation that can write beyond the allocated buffer boundaries. The issue has a CVSS v3.1 Base Score of 8.8 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to memory corruption and other potential consequences when processing malformed video files. The heap buffer overflow could potentially allow attackers to execute arbitrary code or cause denial of service conditions (FFmpeg Ticket).

The vulnerability can be triggered by processing specially crafted video files using FFmpeg's edgedetect filter. A proof of concept exists that demonstrates the heap buffer overflow using Address Sanitizer (ASAN) (FFmpeg Ticket).

The vulnerability has been fixed in multiple distribution releases including Debian 9 (Stretch) version 7:3.2.15-0+deb9u3, Debian 10 (Buster) version 7:4.1.8-0+deb10u1. Users are recommended to upgrade their FFmpeg packages to the latest available version (Debian Security, Debian LTS).