[UPDATE] [medium] ffmpeg: Multiple vulnerabilities

A remote anonymous attacker can exploit these vulnerabilities to create a Denial of Service condition or conduct an unspecified attack.

CSIRTS triage

What: A remote anonymous attacker can exploit these vulnerabilities to create a Denial of Service condition or conduct an unspecified attack.
Who is affected: Deployments of ffmpeg are affected.
Urgency: Remediation is medium urgency due to the potential for denial of service.
Action: Update to the latest version of ffmpeg.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch ffmpeg

Get an email when a new ffmpeg advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-229190.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
Low exploitation riskCVE-2025-229200.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
Low exploitation riskCVE-2025-229210.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
Low exploitation riskCVE-2025-254680.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Low exploitation riskCVE-2025-254690.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Low exploitation riskCVE-2025-254710.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
Low exploitation riskCVE-2025-254730.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2025-22919	coverage & exploitation status	NVD · CVE.org
CVE-2025-22920	coverage & exploitation status	NVD · CVE.org
CVE-2025-22921	coverage & exploitation status	NVD · CVE.org
CVE-2025-25468	coverage & exploitation status	NVD · CVE.org
CVE-2025-25469	coverage & exploitation status	NVD · CVE.org
CVE-2025-25471	coverage & exploitation status	NVD · CVE.org
CVE-2025-25473	coverage & exploitation status	NVD · CVE.org

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.