Skip to content

CVE-2025-12343 on CTRL-OS 26.05

Aliases: CVE-2025-12343

Packages: ffmpeg_8

Status: Resolved, Unaffected

Advisory Information

A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free condition, potentially causing FFmpeg or any application using it to crash when processing TensorFlow-based DNN models. This results in a denial-of-service scenario but does not allow arbitrary code execution under normal conditions.

Updates

2026-08-01 00:22 CEST

Metadata changes:

  • Status for package ffmpeg_8: “Resolved”

(Amended on: 2026-08-01 00:32 CEST)

2026-08-01 00:22 CEST

Metadata changes:

  • Status for package ffmpeg_7: “Resolved”

(Amended on: 2026-08-01 00:32 CEST)

2026-08-01 00:22 CEST

Metadata changes:

  • Status for package ffmpeg_6: “Resolved”

(Amended on: 2026-08-01 00:32 CEST)

2026-08-01 00:22 CEST

Metadata changes:

  • Status for package ffmpeg_4: “Unaffected”

Comment:

Code not present.

(Amended on: 2026-08-01 00:32 CEST)

2026-07-31 01:07 CEST

Metadata changes:

  • Status for package ffmpeg_4: “New”
  • Status for package ffmpeg_6: “New”
  • Status for package ffmpeg_7: “New”
  • Status for package ffmpeg_8: “New”

(Amended on: 2026-08-01 00:22 CEST)