CVE-2025-59731

EUVD-2025-32181

06.10.2025, 08:15

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.

We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.

We recommend upgrading to version 8.0 or beyond.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
Google	CNA	6.9 MEDIUM	ADJACENT	HIGH	LOW	CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
ffmpeg	ffmpeg	𝑥 < 8.0	CNA
ffmpeg	ffmpeg	7.1.1 ≤ 𝑥 < 8.0	CNA

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://issuetracker.google.com/436510153