CVE-2025-8585 libav DSS File Demuxer avconv.c main double free
A double free vulnerability in libav's DSS demuxer allows local attackers to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8585?
CVE-2025-8585 is a medium-severity use after free vulnerability in Libav Libav, published on 5 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability, which was classified as critical, has been found in libav up to 12.3. Affected by this issue is the function main of the file /avtools/avconv.c of the component DSS File Demuxer. The manipulation leads to double free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The bug was initially reported by the researcher to the wrong project. This vulnerability only affects products that are no longer supported by the maintainer.
Which versions are affected by CVE-2025-8585?
It affects 1 product.
Products include Libav Libav.
How do I fix CVE-2025-8585?
No fix has been published for CVE-2025-8585 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-8585 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8585 exists.
Other vulnerabilities in Libav Libav
Sources
Also known as GHSA-328q-vg6x-8ppv, UBUNTU-CVE-2025-8585.