CVE-2025-59731
October 06, 2025
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.
We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.
We recommend upgrading to version 8.0 or beyond.
Affected Packages
ffmpeg (CONAN):
Affected version(s) >=7.0.1 <7.1.2Fix Suggestion:
Update to version 7.1.2https://github.com/FFmpeg/FFmpeg.git (GITHUB):
Affected version(s) >=n7.0 <n7.1.2Fix Suggestion:
Update to version n7.1.2https://github.com/FFmpeg/FFmpeg.git (GITHUB):
Affected version(s) >=n0.5.5 <n5.1.7Fix Suggestion:
Update to version n5.1.7https://github.com/FFmpeg/FFmpeg.git (GITHUB):
Affected version(s) >=n6.0 <n6.1.3Fix Suggestion:
Update to version n6.1.3Related Resources (2)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.9
Attack Vector
ADJACENT
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Out-of-bounds Write
EPSS
Base Score:
0.03
