CVE-2025-59729: ffmpeg Out-of-bounds Write

Vulnerability summary

CVE-2025-59729 is a medium (CVSS 5.7) Out-of-bounds Write vulnerability in ffmpeg. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.7% of scored vulnerabilities.

Timeline

1. 06-10-2025
   PublishedVulnerability first disclosed.
2. 06-10-2025
   Last modifiedVulnerability information updated.

Description

When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have end_buffer_size = 0x100000, and at [2] we have end_buffer_pos = 0x1000. The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we'll calculate end_pos based on a 32-bit offset read from the buffer. There is subsequently a check [3] that end_pos is within the section of the file that has been copied into end_buffer, but it only correctly handles the cases where end_pos is before the start of the file or after the section copied into end_buffer, and not the case where end_pos is within the the file, but before the section copied into end_buffer. If we provide such an offset, (end_pos - end_buffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation. We recommend upgrading to version 8.0 or beyond.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.