{"id":"CVE-2025-59731","aliases":["ALPINE-CVE-2025-59731","DEBIAN-CVE-2025-59731","DSA-5985-1","DSA-6007-1","EUVD-2025-32181","GHSA-p7r5-qh99-qchm","JLSEC-2026-644","MGASA-2025-0306","OESA-2026-3208","OESA-2026-3209","OESA-2026-3210","UBUNTU-CVE-2025-59731"],"status":"published","title":"Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00175,"percentile":0.07115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-08-25T00:00:00Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"ffmpeg","fixed_in":["8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ffmpeg","fixed_in":["8.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:5.1.7-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:7.1.2-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:7.1.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_jll","fixed_in":["8.0.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFplay_jll","fixed_in":["8.1.2+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","fixed_in":["7:4.4.2-0ubuntu0.22.04.1+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","fixed_in":["7:6.1.1-3ubuntu5+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"ffmpeg","fixed_in":["7:7.1.1-1ubuntu4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.7-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.2-0+deb13u1"}]}],"versions":["7:7.1.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.2-1"}]}],"versions":["7:7.1.1-1"]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.7-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1"],"bundled":16},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.2-0+deb13u1"}]}],"versions":["7:7.1.1-1"],"bundled":8},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.1+0"},{"fixed":"8.0.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFplay_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.1+0"},{"fixed":"8.1.2+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7-1.mga9"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7-1.mga9.tainted"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-39.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-39.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-39.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm11"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:6.1.1-3ubuntu5+esm7"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.1-1ubuntu4.2"}]}],"versions":["7:7.1.1-1ubuntu1","7:7.1.1-1ubuntu2","7:7.1.1-1ubuntu3","7:7.1.1-1ubuntu4","7:7.1.1-1ubuntu4.1"]}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://issuetracker.google.com/436510153","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59731","tags":["advisory","web"]},{"url":"https://b.corp.google.com/issues/436510153","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p7r5-qh99-qchm","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-59731","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59731.json","tags":["advisory"]},{"url":"https://git.ffmpeg.org/ffmpeg.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-59731","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0306.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34757","tags":["report"]},{"url":"https://ffmpeg.org/security.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00149.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3209","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3210","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-59731","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59731","tags":["report"]},{"url":"https://issuetracker.google.com/issues/436510153","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7982-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-59731","title":"Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.","status":"published","published":"2025-10-06T08:09:23.41Z","modified":"2026-02-26T17:48:18.117Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:48.167635Z"}],"euvd":[{"id":"EUVD-2025-32181","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.","status":"published","published":"2025-10-06T08:09:23Z","modified":"2026-02-26T17:48:18Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:22.388505Z"}],"ghsa":[{"id":"GHSA-p7r5-qh99-qchm","title":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run...","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.","status":"published","published":"2025-10-06T09:30:20Z","modified":"2025-10-19T15:31:16Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:04:01.823376Z"}],"nvd":[{"id":"CVE-2025-59731","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.","status":"published","published":"2025-10-06T08:15:34.77Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:11:35.93863Z"}],"osv":[{"id":"ALPINE-CVE-2025-59731","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.","status":"published","published":"2025-10-06T08:15:34.77Z","modified":"2026-11-03T06:33:00.953146967Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-59731","title":"Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.","status":"published","published":"2025-10-06T08:09:23.41Z","modified":"2026-10-28T02:30:53.032685221Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"DEBIAN-CVE-2025-59731","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.  We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.     We recommend upgrading to version 8.0 or beyond.","status":"published","published":"2025-10-06T08:15:34.77Z","modified":"2026-10-23T17:47:27.303623245Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"JLSEC-2026-644","title":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of...","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read `rle_raw_size` from the input file at [0], we decompress and decode into the buffer `td-\u003erle_raw_data` of size `rle_raw_size` at [1], and then at [2] we will access entries in this buffer up to `(td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2`, which may exceed `rle_raw_size`.\n\nWe recommend upgrading to version 8.0 or beyond.","status":"published","published":"2026-06-26T20:24:16.337Z","modified":"2026-07-25T18:24:42.861251039Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-3208","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nWhen decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u0026gt;rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u0026gt;xsize - 1) * (td-\u0026gt;ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.(CVE-2025-59731)\n\nInteger overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0.(CVE-2025-63757)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:25.990490165Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3209","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nWhen decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u0026gt;rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u0026gt;xsize - 1) * (td-\u0026gt;ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.(CVE-2025-59731)\n\nInteger overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0.(CVE-2025-63757)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:25.973902286Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3210","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nWhen decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.\n\nWe read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u0026gt;rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u0026gt;xsize - 1) * (td-\u0026gt;ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond.(CVE-2025-59731)\n\nInteger overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0.(CVE-2025-63757)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:25.990176282Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2025-59731","description":"When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-\u003erle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-\u003exsize - 1) * (td-\u003eysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size. We recommend upgrading to version 8.0 or beyond.","status":"published","published":"2025-10-06T08:15:00Z","modified":"2026-04-22T16:07:43.855585Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"DSA-5985-1","title":"ffmpeg - security update","status":"published","published":"2025-08-25T00:00:00Z","modified":"2026-03-09T02:10:26.171906Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6007-1","title":"ffmpeg - security update","status":"published","published":"2025-09-21T00:00:00Z","modified":"2026-03-09T02:09:39.708124Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0306","title":"Updated ffmpeg packages fix security vulnerabilities","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a\nparameter of negative size in the av_samples_set_silence function in\nthelibavutil/samplefmt.c:260:9 component. (CVE-2023-50007)\nFFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the\ncolorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9\ncomponent. (CVE-2023-50008)\nImproper handling of input format in tty demuxer of ffmpeg.\n(CVE-2023-6602)\nHls xbin demuxer dos amplification in ffmpeg. (CVE-2023-6604)\nDash playlist ssrf vulnerability in ffmpeg. (CVE-2023-6605)\nFFmpeg version n6.1 was discovered to contain a heap buffer overflow\nvulnerability in the draw_block_rectangle function of\nlibavfilter/vf_codecview.c. This vulnerability allows attackers to cause\nundefined behavior or a Denial of Service (DoS) via crafted input.\n(CVE-2024-31582)\nFFmpeg n6.1.1 has an Out-of-bounds Read via\nlibavcodec/ppc/vp8dsp_altivec.c, static const vec_s8\nh_subpel_filters_outer. (CVE-2024-35367)\nHeap-buffer-overflow write in FFmpeg MDASH resolve_content_path.\n(CVE-2025-59728)\nHeap-buffer-overflow write in FFmpeg EXR dwa_uncompress.\n(CVE-2025-59731, CVE-2025-59732, CVE-2025-59733)\nNull pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c).\n(CVE-2025-7700)\n","status":"published","published":"2025-11-21T19:56:16Z","modified":"2026-04-16T04:44:27.513245693Z","updated_at":"2026-11-02T15:49:43.178336Z"}]}}