CVE-2025-59731: Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.
We read rlerawsize from the input file at [0], we decompress and decode into the buffer td->rlerawdata of size rlerawsize at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) (td->ysize - 1) + rlerawsize / 2, which may exceed rlerawsize.
We recommend upgrading to version 8.0 or beyond.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:9.0.2-4 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 8.0-r0 - Upgrade
Upgrade
FFmpegto a version that resolves this vulnerability.Fixed in 8.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59731?
CVE-2025-59731 has not been assigned a specific CVSS score, but it represents a significant vulnerability related to the handling of compressed OpenEXR files.
How do I fix CVE-2025-59731?
To fix CVE-2025-59731, update FFmpeg to a version later than 8.0 where the vulnerability is resolved.
What types of systems are affected by CVE-2025-59731?
CVE-2025-59731 specifically affects FFmpeg versions prior to 8.0 that handle OpenEXR files with DWAA or DWAB compression.
What are the potential impacts of CVE-2025-59731?
Exploiting CVE-2025-59731 could lead to buffer overflows, potentially allowing arbitrary code execution.
Is there a way to mitigate the risk of CVE-2025-59731 without updating?
While the best mitigation is to update to a secure version of FFmpeg, users should avoid processing untrusted OpenEXR files as a temporary risk reduction measure.