CVE-2025-12343

A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free condition, potentially causing FFmpeg or any application using it to crash when processing TensorFlow-based DNN models. This results in a denial-of-service scenario but does not allow arbitrary code execution under normal conditions.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-12343	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2406533	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-18 21:16

Updated : 2026-02-26 22:32

NVD link : CVE-2025-12343

Mitre link : CVE-2025-12343

CVE.ORG link : CVE-2025-12343

JSON object : View

Products Affected

ffmpeg

ffmpeg

CWE

CWE-415

Double Free

{"id": "CVE-2025-12343", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2026-02-18T21:16:20.453", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-12343", "tags": ["Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406533", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "patrick@puiterwijk.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg\u2019s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free condition, potentially causing FFmpeg or any application using it to crash when processing TensorFlow-based DNN models. This results in a denial-of-service scenario but does not allow arbitrary code execution under normal conditions."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el backend de TensorFlow de FFmpeg dentro del archivo fuente libavfilter/dnn_backend_tf.c. El problema ocurre en la funci\u00f3n dnn_execute_model_tf(), donde un objeto de tarea se libera m\u00faltiples veces en ciertas rutas de manejo de errores. Esta desasignaci\u00f3n de memoria redundante puede llevar a una condici\u00f3n de doble liberaci\u00f3n, lo que podr\u00eda causar que FFmpeg o cualquier aplicaci\u00f3n que lo use se bloquee al procesar modelos DNN basados en TensorFlow. Esto resulta en un escenario de denegaci\u00f3n de servicio, pero no permite la ejecuci\u00f3n de c\u00f3digo arbitrario bajo condiciones normales."}], "lastModified": "2026-02-26T22:32:44.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A525AFEB-C7C8-4310-A4D1-B776ABEFC206", "versionEndExcluding": "8.1", "versionStartIncluding": "6.1"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}