CVE-2025-25467
Published: 18 February 2025
Description
Adversaries may exploit software vulnerabilities in client applications to execute code.
Security Summary
CVE-2025-25467 is a critical memory management vulnerability in the libx264 git master branch, an open-source H.264 video encoding library. The issue stems from insufficient tracking and releasing of allocated used memory, classified under CWE-94 (Improper Control of Generation of Code). Published on 2025-02-18, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise.
Remote attackers require no privileges or user interaction to exploit this flaw. By creating a specially crafted AAC file and inducing a victim to process it through an application using the vulnerable libx264 git master—such as a media player or video encoder—the attacker can trigger the memory handling defect, leading to arbitrary code execution on the target system.
Mitigation details are available in the upstream issue tracker at https://code.videolan.org/videolan/x264/-/issues/75, where practitioners should check for patches or workarounds applicable to affected builds.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability enables remote arbitrary code execution via a crafted AAC file processed by client applications (e.g., media players or video encoders) using libx264, directly mapping to T1203: Exploitation for Client Execution.