CVE-2025-65834 Memory corruption in n/a
Attackers can cause buffer overflow and potential code execution by tricking users into opening malicious MLT project files with manipulated dimensions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65834?
CVE-2025-65834 is a critical memory corruption vulnerability in n/a, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Meltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow. A memory access violation occurs when processing MLT project files with manipulated width and height parameters. By setting these values to extremely large numbers, the application attempts to allocate excessive memory during image processing, triggering a buffer overflow in the mlt_image_fill_white function.
Weakness: CWE-120
Which versions are affected by CVE-2025-65834?
It affects 1 product.
Linux distribution packages (1)
libmlt openSUSE:Tumbleweed | All versions | 7.36.1-1.1 |
Products include Meltytech Shotcut.
How do I fix CVE-2025-65834?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-65834 being exploited?
There is no known exploitation of CVE-2025-65834 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cvx2-pqgg-cggg, openSUSE-SU-2026:10129-1.