Skip to content
OpenAdvisories
Medium WID-SEC-2025-2130 7 CVEs

ffmpeg: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Sep 24, 2025 · Updated Jun 18, 2026 · Revision 9 · de-DE

Vendor: Fedora Vendor: SUSE Vendor: Ubuntu Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Das FFmpeg-Projekt besteht aus freien Programmen und Bibliotheken, die es ermöglichen, digitales Video- und Audiomaterial aufzunehmen, zu konvertieren, zu streamen und abzuspielen. Zudem enthält es mit libavcodec eine Audio- und Video-Codec-Sammlung, die verschiedene Codecs zur Verfügung stellt.

Vulnerabilities 7

  • High 8.7
    CVE-2025-59728

    Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path

    When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below [0], it returns a buffer precisely allocated to match the string length, usi…

    FFmpeg MPEG-DASH ffmpeg libav Ubuntu Alpine
  • High 8.7
    CVE-2025-59732

    Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

    When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at [0] and [1] will continue to write unti…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Alpine Wolfi
  • High 8.7
    CVE-2025-59733

    Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

    When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type (and size), and that if there are four channels, the first four are "B", "G", "R" and "A". The channel parsing co…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Alpine Wolfi
  • High 8.7
    CVE-2025-59734

    Heap-buffer-overflow write in FFmpeg SANM process_ftch

    It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2. When a STOR chunk is present, a subsequent FOBJ chunk will be saved in ctx->stored_frame. Stored frames can later be referenced by FTCH ch…

    FFmpeg FFmpeg ffmpeg libav Ubuntu Alpine Wolfi
  • Medium 6.9
    CVE-2025-59731

    Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

    When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rle_raw_size from the input file at [0], we decompress and decode into the…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Alpine Wolfi
  • Medium 5.7
    CVE-2025-59729

    Heap-buffer-overflow read in FFmpeg DHAV get_duration

    When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) …

    FFmpeg FFmpeg libav ffmpeg Ubuntu Alpine Wolfi
  • Medium 5.7
    CVE-2025-59730

    Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48

    When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the re…

    FFmpeg FFmpeg libav ffmpeg Ubuntu Alpine Wolfi

Revision history

  1. #9

    Neue Updates von SUSE aufgenommen

  2. #8

    Neue Updates von openSUSE aufgenommen

  3. #7

    Neue Updates von Fedora aufgenommen

  4. #6

    Neue Updates von Ubuntu aufgenommen

  5. #5

    Neue Updates von SUSE aufgenommen

  6. #4

    Neue Updates von SUSE aufgenommen

  7. #3

    Referenz(en) aufgenommen: EUVD-2025-32514, EUVD-2025-32513, EUVD-2025-32515

  8. #2

    Referenz(en) aufgenommen: EUVD-2025-32518, EUVD-2025-32519, EUVD-2025-32516, EUVD-2025-32517

  9. #1

    Initiale Fassung

References