CVE-2025-59729
- Source
- https://cve.org/CVERecord?id=CVE-2025-59729
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59729.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-59729
- Downstream
- Published
- 2025-10-06T08:08:46.060Z
- Modified
- 2026-07-15T01:48:49.774896886Z
- Severity
-
- 5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N CVSS Calculator
- Summary
- Heap-buffer-overflow read in FFmpeg DHAV get_duration
- Details
-
When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer.
If we load a DHAV file that is larger than MAXDURATIONBUFFERSIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have endbuffersize = 0x100000, and at [2] we have endbuffer_pos = 0x1000.
The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we'll calculate end_pos based on a 32-bit offset read from the buffer.
There is subsequently a check [3] that endpos is within the section of the file that has been copied into endbuffer, but it only correctly handles the cases where endpos is before the start of the file or after the section copied into endbuffer, and not the case where endpos is within the the file, but before the section copied into endbuffer. If we provide such an offset, (endpos - endbuffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation.
We recommend upgrading to version 8.0 or beyond.
- Database specific
{ "cwe_ids": [ "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59729.json", "cna_assigner": "Google" }- References