CVE-2025-65834
📋 TL;DR
CVE-2025-65834 is a critical buffer overflow vulnerability in Shotcut video editor that allows remote code execution when processing malicious MLT project files. Attackers can craft files with manipulated width/height parameters to trigger memory corruption. All users running vulnerable versions are affected.
💻 Affected Systems
- Meltytech Shotcut
📦 What is this software?
Shotcut by Meltytech
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Shotcut process, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Application crash (denial of service) or arbitrary code execution when users open malicious project files from untrusted sources.
If Mitigated
Limited to application crash if exploit fails or memory protections prevent code execution.
🎯 Exploit Status
Exploitation requires user to open a malicious MLT project file; no authentication needed. The vulnerability is in file parsing logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not yet released
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Monitor Shotcut official channels for security updates. 2. When patch is released, download and install the updated version. 3. Restart the application after installation.
🔧 Temporary Workarounds
Avoid untrusted MLT files
allDo not open MLT project files from unknown or untrusted sources.
Use application sandboxing
allRun Shotcut in a sandboxed environment to limit potential damage from exploitation.
🧯 If You Can't Patch
- Discontinue use of Shotcut until patch is available and tested
- Implement network segmentation to isolate systems running vulnerable versions
🔍 How to Verify
Check if Vulnerable:
Check Shotcut version via Help > About menu; if version is 25.10.31 or potentially earlier, system is vulnerable.Check Version:
On Linux: shotcut --version; On Windows/macOS: Check via GUI Help > AboutVerify Fix Applied:
After patching, verify version is higher than 25.10.31 via Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crash logs mentioning mlt_image_fill_white
- Unexpected memory allocation failures
Network Indicators:
- Downloads of MLT files from suspicious sources
SIEM Query:
Process:shotcut AND (EventID:1000 OR ExceptionCode:c0000005)