CVE-2025-25467: 
Ffmpeg vulnerability analysis and mitigation

Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file. The vulnerability was discovered in February 2025 and assigned CVE-2025-25467. The issue affects the libx264 library, which is commonly used for H.264 video encoding (NVD).

The vulnerability stems from improper memory management in libx264's git master branch. The issue manifests as a direct leak of 136 bytes in one object and an indirect leak of 30 bytes in two objects, as detected by AddressSanitizer. The vulnerability received a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD). The issue is specifically related to the x264_encoder_open() function failing to perform proper cleanup (VideoLAN Issue).

The vulnerability allows attackers to execute arbitrary code through a crafted AAC file, potentially leading to complete system compromise. The high CVSS score indicates that the vulnerability can be exploited remotely without requiring privileges or user interaction, and can affect the confidentiality, integrity, and availability of the system (NVD).