CVE-2025-65834: 
NixOS vulnerability analysis and mitigation

CVE-2025-65834 is a classic buffer overflow vulnerability in Meltytech Shotcut version 25.10.31, a popular open-source video editing application. The flaw occurs during image processing of MLT project files when width and height parameters are manipulated to extremely large values, causing the application to attempt excessive memory allocation and triggering a buffer overflow in the mlt_image_fill_white function. It was published on December 16, 2025, and carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, ENISA EUVD).

The vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input — 'Classic Buffer Overflow'). When Shotcut parses an MLT project file, it reads user-controlled width and height parameters without adequate bounds checking, passing them directly into image allocation and fill routines. Setting these values to extremely large integers causes the mlt_image_fill_white function to attempt allocating and writing to a memory region far exceeding what was actually allocated, resulting in a memory access violation. The attack vector is listed as Network with no privileges or user interaction required, though in practice a victim would need to open a maliciously crafted MLT file (Red Hat CVE, ENISA EUVD).

Successful exploitation could allow an attacker to crash the Shotcut application (denial of service) or potentially execute arbitrary code in the context of the user running Shotcut, compromising confidentiality, integrity, and availability of the affected system. If exploited for code execution, an attacker could gain unauthorized access to the user's system, access sensitive files, or use the compromised host as a pivot point for further lateral movement. The CVSS score reflects high impact across all three security pillars (Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (ENISA EUVD). The EPSS score is approximately 0.018% (0.000180), indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious MLT project file: Create or modify an MLT XML project file, setting the width and height attributes of an image or producer element to extremely large integer values (e.g., 2147483647 or similar near-maximum values).
2. Deliver the file to the target: Distribute the malicious .mlt file to a victim via email attachment, file sharing, or by hosting it on a website and social-engineering the victim into downloading it.
3. Victim opens the file in Shotcut 25.10.31: When the victim opens the crafted project file, Shotcut parses the manipulated parameters and passes them to the image processing pipeline.
4. Trigger buffer overflow: The mlt_image_fill_white function attempts to allocate and write to a memory region sized according to the oversized dimensions, causing a memory access violation.
5. Achieve crash or code execution: Depending on memory layout and platform mitigations, the overflow may crash the application (DoS) or, with further exploitation refinement, enable arbitrary code execution in the context of the victim user (ENISA EUVD, Red Hat CVE).

• File System: Presence of unexpected or externally sourced .mlt project files with anomalously large width or height attribute values in XML content.
• Process: Shotcut process (shotcut, shotcut.exe) terminating abnormally with access violation or segmentation fault signals; unexpected child processes spawned by Shotcut.
• Logs: Application crash reports or core dumps referencing mlt_image_fill_white in the stack trace; OS-level crash logs (e.g., Windows Event Log Application errors, Linux dmesg segfault entries) tied to the Shotcut process.
• Network: Unexpected outbound network connections from the Shotcut process following the opening of an MLT file (potential indicator of post-exploitation activity).

Meltytech released Shotcut version 25.12.30 as a new release following the disclosure; users should update to this or any later version as soon as possible (Shotcut Blog). As an interim workaround, users should avoid opening MLT project files from untrusted or unknown sources. Organizations can implement application whitelisting and restrict access to the Shotcut application to trusted users only. Strict input validation for width and height parameters in MLT file parsing is the recommended long-term code-level fix (ENISA EUVD).

The vulnerability received brief coverage on Mastodon/InfoSec.Exchange via TheHackerWire shortly after disclosure (TheHackerWire). Red Hat and INCIBE (Spain's national cybersecurity agency) published advisories tracking the CVE (Red Hat CVE, INCIBE). No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregator listings.