CVE-2025-59731
published 2025-10-06CVE-2025-59731: When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate…
PriorityP426medium6.9CVSS 4.0
AVAACHATNPRLUIPVCHVIHVANSCHSIHSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.16%
5.7th percentile
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.
We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.
We recommend upgrading to version 8.0 or beyond.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ffmpeg | < ffmpeg 7:5.1.7-0+deb12u1 (bookworm) | ffmpeg 7:5.1.7-0+deb12u1 (bookworm) |
| ffmpeg | ffmpeg | >= 0 < 7:5.1.7-0+deb12u1 | 7:5.1.7-0+deb12u1 |
| ffmpeg | ffmpeg | >= 0 < 7:7.1.2-0+deb13u1 | 7:7.1.2-0+deb13u1 |
| ffmpeg | ffmpeg | >= 0 < 7:7.1.2-1 | 7:7.1.2-1 |
| ffmpeg | ffmpeg | >= 0 < 7:7.1.1-1ubuntu4.2 | 7:7.1.1-1ubuntu4.2 |
| ffmpeg | ffmpeg | >= 0 < 7:2.8.17-0ubuntu0.1+esm14 | 7:2.8.17-0ubuntu0.1+esm14 |
| ffmpeg | ffmpeg | >= 0 < 7:3.4.11-0ubuntu0.1+esm12 | 7:3.4.11-0ubuntu0.1+esm12 |
| ffmpeg | ffmpeg | >= 0 < 7:4.2.7-0ubuntu0.1+esm12 | 7:4.2.7-0ubuntu0.1+esm12 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4.2-0ubuntu0.22.04.1+esm11 | 7:4.4.2-0ubuntu0.22.04.1+esm11 |
| ffmpeg | ffmpeg | >= 0 < 7:6.1.1-3ubuntu5+esm7 | 7:6.1.1-3ubuntu5+esm7 |
| ffmpeg | ffmpeg | >= 7.1.1 < 8.0 | 8.0 |
| ffmpeg | ffmpeg | >= 9a32b863074ed4140141e0d3613905c6f1fe61c5 < 8.0 | 8.0 |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.7HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FFmpeg vulnerabilities
vendor_ubuntu·2026-01-27·CVSS 7.5
CVE-2025-59728 [HIGH] FFmpeg vulnerabilities
Title: FFmpeg vulnerabilities
Summary: Several security issues were fixed in FFmpeg.
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10.
(CVE-2025-59728)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-59731,
CVE-2025-59732)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to
Debian
CVE-2025-59731: ffmpeg - When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified ...
vendor_debian·2025·CVSS 6.9
CVE-2025-59731 [MEDIUM] CVE-2025-59731: ffmpeg - When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified ...
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size. We recommend upgrading to version 8.0 or beyond.
Scope: local
bookworm: resolved (fixed in 7:5.1.7-0+deb12u1)
bullseye: resolved
forky: resolved (fixed in 7:7.1.2-1)
sid: resolved (fixed in 7:7.1.2-1)
trixie: resolved (fixed in 7:7.1.2-0+deb13u1)
OSV
ffmpeg vulnerabilities
osv·2026-01-27·CVSS 8.7
CVE-2025-59728 [HIGH] ffmpeg vulnerabilities
ffmpeg vulnerabilities
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10.
(CVE-2025-59728)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-59731,
CVE-2025-59732)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue
OSV
CVE-2025-59731: When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to
osv·2025-10-06·CVSS 6.9
CVE-2025-59731 [MEDIUM] CVE-2025-59731: When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size. We recommend upgrading to version 8.0 or beyond.
GHSA
GHSA-p7r5-qh99-qchm: When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to
ghsa_unreviewed·2025-10-06
CVE-2025-59731 [MEDIUM] CWE-787 GHSA-p7r5-qh99-qchm: When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.
We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.
We recommend upgrading to version 8.0 or beyond.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [fedora-42]
bugzilla·2025-11-28·CVSS 6.9
CVE-2025-59731 [MEDIUM] CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [fedora-42]
CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all b
Bugzilla
CVE-2025-59731 qt5-qtwebengine: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [fedora-42]
bugzilla·2025-11-28·CVSS 6.9
CVE-2025-59731 [MEDIUM] CVE-2025-59731 qt5-qtwebengine: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [fedora-42]
CVE-2025-59731 qt5-qtwebengine: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to cl
Bugzilla
CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [epel-9]
bugzilla·2025-10-06·CVSS 6.9
CVE-2025-59731 [MEDIUM] CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [epel-9]
CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
A.k.a. BIGSLEEP-436510153
Fixed in 5.1.7: https://github.com/FFmpeg/FFmpeg/commit/ec959281897aa29076f3083edbc2306357342d7c
---
FEDORA-EPEL-2026-7e25a1d2ec (ffmpeg-5.1.9-1.el9) has been submitted as
Bugzilla
CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [epel-10]
bugzilla·2025-10-06·CVSS 6.9
CVE-2025-59731 [MEDIUM] CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [epel-10]
CVE-2025-59731 ffmpeg: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
A.k.a. BIGSLEEP-436510153.
Fixed in 7.1.2: https://github.com/FFmpeg/FFmpeg/commit/d7e188f33f638d85a1ab70943bde70359454b05c .
2025-10-06
Published