fm0ss/cve-2025-9951-ffmpeg-jp2-pocProof-of-concept for CVE-2025-9951 demonstrating controlled callback execution in FFmpeg via JPEG 2000 component-mapping mismatch. Includes write-up, payload generator, and GDB launch script for deterministic-layout exploitation research.
This repository contains two deliberately separated exploitation milestones for the FFmpeg JPEG 2000 component-mapping vulnerability:
01-gdb-assisted/ — the original deterministic
GDB-launched PoC and its full research-journey writeup, restored from the
last GDB-only historical revision (260cee4).02-aslr-setcontext/ — the later ASLR-enabled,
same-process disclosure and setcontext proof, with a concise second
writeup and minimal source required to reproduce it.The first directory preserves the original 450-byte marker-file payload. The
second demonstrates controlled instruction flow and register state outside
GDB while ASLR remains enabled. Its published runner ends safely at
_exit(90); the writeup separately records the follow-on
/shellcode experiment and its limitations.
mprotectThese are environment-specific research artifacts, not a portable remote exploit. Use them only against systems you own or are explicitly authorized to test.