CVE-2025-59731

EUVD-2025-32181

06.10.2025, 08:15

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.

We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.

We recommend upgrading to version 8.0 or beyond.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
Google	CNA	6.9 MEDIUM	ADJACENT	HIGH	LOW	CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 5.83%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
ffmpeg	ffmpeg	𝑥 < 8.0	CNA
ffmpeg	ffmpeg	7.1.1 ≤ 𝑥 < 8.0	CNA

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	7:5.1.9-0+deb12u1 fixed
bookworm (security)	7:5.1.9-0+deb12u1 fixed
bullseye	7:4.3.7-0+deb11u1 fixed
bullseye (security)	7:4.3.9-0+deb11u2 fixed
forky	7:8.1.2-2 fixed
sid	7:8.1.2-2 fixed
trixie	7:7.1.5-0+deb13u1 fixed
trixie (security)	7:7.1.5-0+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	not-affected
focal	not-affected
jammy	Fixed 7:4.4.2-0ubuntu0.22.04.1+esm11 released
noble	Fixed 7:6.1.1-3ubuntu5+esm7 released
plucky	ignored
questing	Fixed 7:7.1.1-1ubuntu4.2 released
resolute	not-affected
xenial	not-affected

libav

jammy	dne
noble	dne
plucky	dne
questing	dne
resolute	dne
trusty	needs-triage

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://issuetracker.google.com/436510153