CVE-2025-59732: ffmpeg Out-of-bounds Write
Vulnerability summary
CVE-2025-59732 is a high (CVSS 8.7) Out-of-bounds Write vulnerability in ffmpeg. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 06-10-2025PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at [0] and [1] will continue to write until the next multiple of 8. The buffer td->uncompressed_data is allocated in decode_block based on the precise height and width of the image, so the "rounded-up" multiple of 8 in the copy loop can exceed the buffer bounds, and the write block starting at [2] can corrupt following heap memory. We recommend upgrading to version 8.0 or beyond.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- OSV · DebianEcosystem advisory · calculated8.7HighCVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
0.00 pp
From 0.19% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- eco-python-ffmpeg-7-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimal-devAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimal-staticAll versions (No fix recorded)
- ffmpeg-7All versions (No fix recorded)
- ffmpeg-7.1All versions (No fix recorded)
Ubuntu2 products
- ffmpeg< 7:4.4.2-0ubuntu0.22.04.1+esm11 | < 7:6.1.1-3ubuntu5+esm7 | < 7:7.1.1-1ubuntu4.2
- libavAll versions (No fix recorded)
Wolfi2 products
- ffmpeg-7All versions (No fix recorded)
- ffmpeg-7.1All versions (No fix recorded)
Debian1 product
- ffmpeg< 7:5.1.7-0+deb12u1 | < 7:7.1.2-0+deb13u1 | < 7:7.1.2-1
Ffmpeg1 product
- ffmpeg≥ 9a32b863074ed4140141e0d3613905c6f1fe61c5, < 8.0 | ≥ 7.1.1, < 8.0
5 vendors · 14 products
References
9 links
- git.ffmpeg.org/ffmpeg.gitPACKAGE