CVE-2025-69693: 
Ffmpeg vulnerability analysis and mitigation

CVE-2025-69693 is an out-of-bounds read vulnerability in the FFmpeg RV60 video decoder (libavcodec/rv60dec.c), affecting FFmpeg versions 8.0 (released 2025-08-22) and 8.0.1 (released 2025-11-20). The flaw arises from missing upper bound validation on the quantization parameter (qp), allowing it to exceed the valid index range of the rv60_qp_to_idx array. It was disclosed on March 16, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read). In decode_slice() at line 2267 of rv60dec.c, the qp value is validated only for a lower bound (qp < 0), with no upper bound check. The qp value is computed as the sum of a 6-bit frame header base value (0–63) and a slice-level offset (up to +2 from read_qp_offset), meaning it can reach 65. Since the rv60_qp_to_idx array has only 64 entries (valid indices 0–63), this triggers out-of-bounds array accesses at lines 1554 (decode_cbp8), 1655 (decode_cbp16), and 1419/1421 (get_c4x4_set). A prior fix in commit 61cbcaf93f addressed a related issue only for intra frames, leaving inter-frame paths unprotected. The fix in commit 8abeb879df changes the condition to if (qp < 0 || qp >= 64) (FFmpeg Commit, Red Hat Bugzilla).

Successful exploitation can result in memory disclosure — where adjacent heap or stack memory is read and potentially exposed to an attacker — or an application crash causing denial of service. Because user interaction is required (the victim must open or process a crafted RV60 video file), the confidentiality and availability impacts are rated low, with no integrity impact. Applications that automatically process untrusted video content (e.g., media servers, transcoding pipelines) face elevated risk (Red Hat Advisory, FFmpeg Commit).

1. Craft a malicious RV60 video file: Create an RV60-encoded video where the frame header encodes a base qp value of 63 (maximum for a 6-bit field) and the slice data encodes a qp offset of +2 via read_qp_offset, resulting in a computed qp of 65.
2. Deliver the file to the target: Distribute the malicious video via email attachment, web download, or any channel where the victim's system will process it with a vulnerable FFmpeg 8.0 or 8.0.1 build.
3. Trigger decoding: Cause the target application (e.g., a media player, transcoder, or streaming server using FFmpeg) to decode the malicious file, invoking decode_slice() in rv60dec.c.
4. Out-of-bounds read occurs: The unvalidated qp value (65) is used to index rv60_qp_to_idx[65], reading one byte beyond the array boundary in decode_cbp8(), decode_cbp16(), or get_c4x4_set().
5. Achieve objective: Depending on memory layout, the attacker may obtain leaked memory contents (information disclosure) or cause the FFmpeg process to crash (denial of service) (FFmpeg Commit, Red Hat Bugzilla).

• Logs: Application or system logs showing FFmpeg crashes or AVERROR_INVALIDDATA errors when processing RV60 video files; unexpected segmentation faults or abort signals from FFmpeg processes.
• File System: Presence of unusual or unexpected .rm, .rmvb, or raw RV60-encoded video files in temporary directories or download folders.
• Process: FFmpeg processes terminating abnormally (non-zero exit codes) when handling RV60 content; core dump files generated by FFmpeg in working directories.
• Network: Unusual inbound delivery of RV60 video files from untrusted sources to systems running FFmpeg-based media processing pipelines.

The fix is available in FFmpeg git master commit 8abeb879df and will be included in the upcoming FFmpeg 8.1 release. Organizations running FFmpeg 8.0 or 8.0.1 should upgrade to FFmpeg 8.1 or later as soon as it is available. As an interim measure, restrict FFmpeg from processing untrusted RV60 video content, implement input validation to reject RV60 files from untrusted sources, and consider running video processing workloads in sandboxed or containerized environments to limit the blast radius of potential exploitation (FFmpeg Commit, Red Hat Advisory).

Red Hat tracked the vulnerability via its Product Security team and opened a Bugzilla entry (Bug 2448195) shortly after disclosure, assigning it medium priority and severity. The Yocto Project security mailing list discussed the CVE in the context of OE-Core CVE metrics across multiple weekly updates, indicating awareness in embedded Linux communities. No significant public researcher commentary or media coverage beyond standard vulnerability database entries has been observed (Red Hat Bugzilla).