CVE-2025-59731 — Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

Affected: FFmpeg

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.

We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.

We recommend upgrading to version 8.0 or beyond.

USN-7982-1 — ffmpeg vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: ffmpeg, Ubuntu:Pro:18.04:LTS: ffmpeg, Ubuntu:Pro:20.04:LTS: ffmpeg, Ubuntu:Pro:22.04:LTS: ffmpeg, Ubuntu:Pro:24.04:LTS: ffmpeg, Ubuntu:25.10: ffmpeg

It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-59728)

It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-59731, CVE-2025-59732)

It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-59733)

It was discovered that FFmpeg did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-63757)

Most recent entries from all

CVE-2025-59731 — Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

USN-7982-1 — ffmpeg vulnerabilities