UNKNOWN READ Vulnerability in mpv Package
Summary
OSV-2025-591: UNKNOWN READ in mov_read_header. Affects mpv versions >= 71a6535b05c6e2e235da2d034290a1918f7c2567, < 86e12929aa0bbc61946d3804982acf887786a7cb. Fixed in 86e12929aa0bbc61946d3804982acf887786a7cb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mpv is a versatile media player that supports a wide range of video and audio formats. It is known for its high-quality playback and extensive customization options. However, like many open-source projects, it can be susceptible to vulnerabilities that may affect its stability and security. This particular vulnerability relates to an issue in the mov_read_header function, which can lead to crashes during media playback.
Vulnerability Detail
The vulnerability identified as OSV-2025-591 is classified as an UNKNOWN READ error occurring in the mov_read_header function of the mpv package. This issue arises from improper handling of input data, which can lead to crashes during the media opening process. The ramifications of this vulnerability include potential application crashes and a degraded user experience, particularly when attempting to play certain media files. The vulnerability was reported through OSS-Fuzz, highlighting its significance in maintaining the integrity of the mpv media player.
How To Fix
Minimum fixed version
86e12929aa0bbc61946d3804982acf887786a7cb
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid playing media files that may trigger this vulnerability until the package is updated. Monitoring the application logs for any crash reports can also help identify problematic files.
Conclusion
The UNKNOWN READ vulnerability in the mpv package poses a risk of application crashes during media playback. Users are advised to update to the latest patched version to mitigate this issue. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mpv →
FAQ
It is a crash issue that occurs in the mov_read_header function, leading to application instability when opening certain media files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The primary impact is application crashes, which can disrupt media playback and affect user experience.
Yes, a patched version of the mpv package is available. Users should update to version 86e12929aa0bbc61946d3804982acf887786a7cb.
As a temporary measure, avoid playing media files that may trigger the vulnerability and monitor application logs for crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for mpv.
