Vulnerability-Lookup

UBUNTU-CVE-2025-59734 (CVE-2025-59734)

Vulnerability from osv_ubuntu – Published: 2025-10-06 08:15 – Updated: 2026-10-12 23:19 – Source website

Details

It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2. When a STOR chunk is present, a subsequent FOBJ chunk will be saved in ctx->stored_frame. Stored frames can later be referenced by FTCH chunks. For files using subversion < 2, the undecoded frame is stored, and decoded again when the FTCH chunks are parsed. However, in process_frame_obj if the frame has an invalid size, there’s an early return, with a value of 0. This causes the code in decode_frame to still store the raw frame buffer into ctx->stored_frame. Leaving ctx->has_dimensions set to false. A subsequent chunk with type FTCH would call process_ftch and decode that frame obj again, adding to the top/left values and calling process_frame_obj again. Given that we never set ctx->have_dimensions before, this time we set the dimensions, calling init_buffers, which can reallocate the buffer in ctx->stored_frame, freeing the previous one. However, the GetByteContext object gb still holds a reference to the old buffer. Finally, when the code tries to decode the frame, codecs that accept a GetByteContext as a parameter will trigger a use-after-free read when using gb. GetByteContext is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the free and when the object is accessed. However, upon returning to process_ftch, the code restores the original values for top/left in stored_frame, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator’s metadata. This issue can be triggered just by probing whether a file has the sanm format. We recommend upgrading to version 8.0 or beyond.

Severity

8.7 (High)


                    
                      CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-59734	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-59734	REPORT
	https://issuetracker.google.com/issues/440183164	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libav-tools",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavcodec-extra",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavcodec-extra-54",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavcodec54",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavdevice-extra-53",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavdevice53",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavfilter-extra-3",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavfilter3",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavformat-extra-54",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavformat54",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavresample1",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavutil-extra-52",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libavutil52",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libswscale-extra-2",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          },
          {
            "binary_name": "libswscale2",
            "binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libav",
        "purl": "pkg:deb/ubuntu/libav@6:9.20-0ubuntu0.14.04.1+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6:0.8.7-1ubuntu2",
        "6:9.10-1ubuntu1",
        "6:9.10-1ubuntu2",
        "6:9.10-1ubuntu5",
        "6:9.10-1ubuntu6",
        "6:9.10-1ubuntu7",
        "6:9.11-2ubuntu1",
        "6:9.11-2ubuntu2",
        "6:9.13-0ubuntu0.14.04.1",
        "6:9.14-0ubuntu0.14.04.1",
        "6:9.16-0ubuntu0.14.04.1",
        "6:9.18-0ubuntu0.14.04.1",
        "6:9.20-0ubuntu0.14.04.1",
        "6:9.20-0ubuntu0.14.04.1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ffmpeg",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libav-tools",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavcodec-extra",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavcodec-ffmpeg-extra56",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavcodec-ffmpeg56",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavdevice-ffmpeg56",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavfilter-ffmpeg5",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavformat-ffmpeg56",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavresample-ffmpeg2",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavutil-ffmpeg54",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libpostproc-ffmpeg53",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libswresample-ffmpeg1",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libswscale-ffmpeg3",
            "binary_version": "7:2.8.17-0ubuntu0.1+esm18"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "ffmpeg",
        "purl": "pkg:deb/ubuntu/ffmpeg@7:2.8.17-0ubuntu0.1+esm18?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7:2.7.2-1build1",
        "7:2.8.1-1ubuntu1",
        "7:2.8.2-1ubuntu1",
        "7:2.8.3-1",
        "7:2.8.4-1",
        "7:2.8.4-1ubuntu1",
        "7:2.8.4-1ubuntu2",
        "7:2.8.4-1ubuntu3",
        "7:2.8.4-1ubuntu4",
        "7:2.8.6-1ubuntu1",
        "7:2.8.6-1ubuntu2",
        "7:2.8.8-0ubuntu0.16.04.1",
        "7:2.8.10-0ubuntu0.16.04.1",
        "7:2.8.11-0ubuntu0.16.04.1",
        "7:2.8.14-0ubuntu0.16.04.1",
        "7:2.8.15-0ubuntu0.16.04.1",
        "7:2.8.15-0ubuntu0.16.04.1+esm1",
        "7:2.8.17-0ubuntu0.1",
        "7:2.8.17-0ubuntu0.1+esm1",
        "7:2.8.17-0ubuntu0.1+esm2",
        "7:2.8.17-0ubuntu0.1+esm3",
        "7:2.8.17-0ubuntu0.1+esm4",
        "7:2.8.17-0ubuntu0.1+esm5",
        "7:2.8.17-0ubuntu0.1+esm6",
        "7:2.8.17-0ubuntu0.1+esm7",
        "7:2.8.17-0ubuntu0.1+esm8",
        "7:2.8.17-0ubuntu0.1+esm9",
        "7:2.8.17-0ubuntu0.1+esm10",
        "7:2.8.17-0ubuntu0.1+esm11",
        "7:2.8.17-0ubuntu0.1+esm12",
        "7:2.8.17-0ubuntu0.1+esm13",
        "7:2.8.17-0ubuntu0.1+esm14",
        "7:2.8.17-0ubuntu0.1+esm15",
        "7:2.8.17-0ubuntu0.1+esm16",
        "7:2.8.17-0ubuntu0.1+esm17",
        "7:2.8.17-0ubuntu0.1+esm18"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ffmpeg",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavcodec-extra",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavcodec-extra57",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavcodec57",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavdevice57",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavfilter-extra",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavfilter-extra6",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavfilter6",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavformat57",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavresample3",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libavutil55",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libpostproc54",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libswresample2",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          },
          {
            "binary_name": "libswscale4",
            "binary_version": "7:3.4.11-0ubuntu0.1+esm16"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "ffmpeg",
        "purl": "pkg:deb/ubuntu/ffmpeg@7:3.4.11-0ubuntu0.1+esm16?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7:3.3.4-2",
        "7:3.3.4-2build3",
        "7:3.4-2ubuntu2",
        "7:3.4-4",
        "7:3.4-4build1",
        "7:3.4.1-1",
        "7:3.4.1-1build1",
        "7:3.4.2-1",
        "7:3.4.2-1build1",
        "7:3.4.2-2",
        "7:3.4.4-0ubuntu0.18.04.1",
        "7:3.4.6-0ubuntu0.18.04.1",
        "7:3.4.8-0ubuntu0.2",
        "7:3.4.11-0ubuntu0.1",
        "7:3.4.11-0ubuntu0.1+esm1",
        "7:3.4.11-0ubuntu0.1+esm2",
        "7:3.4.11-0ubuntu0.1+esm3",
        "7:3.4.11-0ubuntu0.1+esm4",
        "7:3.4.11-0ubuntu0.1+esm5",
        "7:3.4.11-0ubuntu0.1+esm6",
        "7:3.4.11-0ubuntu0.1+esm7",
        "7:3.4.11-0ubuntu0.1+esm8",
        "7:3.4.11-0ubuntu0.1+esm9",
        "7:3.4.11-0ubuntu0.1+esm10",
        "7:3.4.11-0ubuntu0.1+esm11",
        "7:3.4.11-0ubuntu0.1+esm12",
        "7:3.4.11-0ubuntu0.1+esm13",
        "7:3.4.11-0ubuntu0.1+esm14",
        "7:3.4.11-0ubuntu0.1+esm15",
        "7:3.4.11-0ubuntu0.1+esm16"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ffmpeg",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavcodec-extra",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavcodec-extra58",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavcodec58",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavdevice58",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavfilter-extra",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavfilter-extra7",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavfilter7",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavformat58",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavresample4",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libavutil56",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libpostproc55",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libswresample3",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          },
          {
            "binary_name": "libswscale5",
            "binary_version": "7:4.2.7-0ubuntu0.1+esm18"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "ffmpeg",
        "purl": "pkg:deb/ubuntu/ffmpeg@7:4.2.7-0ubuntu0.1+esm18?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7:4.1.4-1build2",
        "7:4.2.1-2",
        "7:4.2.1-2ubuntu1",
        "7:4.2.2-1build1",
        "7:4.2.2-1ubuntu1",
        "7:4.2.4-1ubuntu0.1",
        "7:4.2.4-1ubuntu0.1+esm1",
        "7:4.2.7-0ubuntu0.1",
        "7:4.2.7-0ubuntu0.1+esm1",
        "7:4.2.7-0ubuntu0.1+esm2",
        "7:4.2.7-0ubuntu0.1+esm3",
        "7:4.2.7-0ubuntu0.1+esm4",
        "7:4.2.7-0ubuntu0.1+esm5",
        "7:4.2.7-0ubuntu0.1+esm6",
        "7:4.2.7-0ubuntu0.1+esm7",
        "7:4.2.7-0ubuntu0.1+esm8",
        "7:4.2.7-0ubuntu0.1+esm9",
        "7:4.2.7-0ubuntu0.1+esm10",
        "7:4.2.7-0ubuntu0.1+esm11",
        "7:4.2.7-0ubuntu0.1+esm12",
        "7:4.2.7-0ubuntu0.1+esm13",
        "7:4.2.7-0ubuntu0.1+esm14",
        "7:4.2.7-0ubuntu0.1+esm15",
        "7:4.2.7-0ubuntu0.1+esm16",
        "7:4.2.7-0ubuntu0.1+esm17",
        "7:4.2.7-0ubuntu0.1+esm18"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ffmpeg",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavcodec-extra",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavcodec-extra58",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavcodec58",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavdevice58",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavfilter-extra",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavfilter-extra7",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavfilter7",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavformat-extra",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavformat-extra58",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavformat58",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libavutil56",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libpostproc55",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libswresample3",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libswscale5",
            "binary_version": "7:4.4.2-0ubuntu0.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "ffmpeg",
        "purl": "pkg:deb/ubuntu/ffmpeg@7:4.4.2-0ubuntu0.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7:4.4-6ubuntu5",
        "7:4.4.1-2ubuntu1",
        "7:4.4.1-3ubuntu1",
        "7:4.4.1-3ubuntu2",
        "7:4.4.1-3ubuntu3",
        "7:4.4.1-3ubuntu5",
        "7:4.4.2-0ubuntu0.22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ffmpeg",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavcodec-extra",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavcodec-extra60",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavcodec60",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavdevice60",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavfilter-extra",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavfilter-extra9",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavfilter9",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavformat-extra",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavformat-extra60",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavformat60",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libavutil58",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libpostproc57",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libswresample4",
            "binary_version": "7:6.1.1-3ubuntu5"
          },
          {
            "binary_name": "libswscale7",
            "binary_version": "7:6.1.1-3ubuntu5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "ffmpeg",
        "purl": "pkg:deb/ubuntu/ffmpeg@7:6.1.1-3ubuntu5?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7:6.0-6ubuntu1",
        "7:6.0-9ubuntu1",
        "7:6.1-2ubuntu1",
        "7:6.1-3ubuntu1",
        "7:6.1-4ubuntu1",
        "7:6.1-5ubuntu1",
        "7:6.1.1-1ubuntu1",
        "7:6.1.1-3ubuntu1",
        "7:6.1.1-3ubuntu5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ffmpeg",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavcodec-extra",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavcodec-extra61",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavcodec61",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavdevice61",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavfilter-extra",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavfilter-extra10",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavfilter10",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavformat-extra",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavformat-extra61",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavformat61",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libavutil59",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libpostproc58",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libswresample5",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          },
          {
            "binary_name": "libswscale8",
            "binary_version": "7:7.1.1-1ubuntu4.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "ffmpeg",
        "purl": "pkg:deb/ubuntu/ffmpeg@7:7.1.1-1ubuntu4.2?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7:7.1.1-1ubuntu1",
        "7:7.1.1-1ubuntu2",
        "7:7.1.1-1ubuntu3",
        "7:7.1.1-1ubuntu4",
        "7:7.1.1-1ubuntu4.1",
        "7:7.1.1-1ubuntu4.2"
      ]
    }
  ],
  "aliases": [],
  "details": "It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion \u003c2. When a STOR\u00a0chunk is present, a subsequent FOBJ\u00a0chunk will be saved in ctx-\u003estored_frame. Stored frames can later be referenced by FTCH\u00a0chunks. For files using subversion \u003c 2, the undecoded frame is stored, and decoded again when the FTCH\u00a0chunks are parsed.\u00a0However, in process_frame_obj\u00a0if the frame has an invalid size, there\u2019s an early return, with a value of 0. This causes the code in decode_frame\u00a0to still store the raw frame buffer into ctx-\u003estored_frame. Leaving ctx-\u003ehas_dimensions\u00a0set to false. A subsequent chunk with type FTCH\u00a0would call process_ftch\u00a0and decode that frame obj again, adding to the top/left values and calling process_frame_obj\u00a0again. Given that we never set ctx-\u003ehave_dimensions\u00a0before, this time we set the dimensions, calling init_buffers, which can reallocate the buffer in ctx-\u003estored_frame, freeing the previous one. However, the GetByteContext\u00a0object gb\u00a0still holds a reference to the old buffer. Finally, when the code tries to decode the frame, codecs that accept a GetByteContext\u00a0as a parameter will trigger a use-after-free read when using gb. GetByteContext\u00a0is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the free\u00a0and when the object is accessed. However, upon returning to process_ftch, the code restores\u00a0the original values for top/left in stored_frame, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator\u2019s metadata. This issue can be triggered just by probing whether a file has the sanm format. We recommend upgrading to version 8.0 or beyond.",
  "id": "UBUNTU-CVE-2025-59734",
  "modified": "2026-10-12T23:19:35Z",
  "published": "2025-10-06T08:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-59734"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-59734"
    },
    {
      "type": "REPORT",
      "url": "https://issuetracker.google.com/issues/440183164"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-59734"
  ]
}

CVE-2025-59734 (GCVE-0-2025-59734)

Vulnerability from cvelistv5 – Published: 2025-10-06 08:09 – Updated: 2026-02-26 17:48

Title

Heap-buffer-overflow write in FFmpeg SANM process_ftch

Summary

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-08 03:55 UTC

CWE

CWE-416 - Use After Free

Assigner

Google CNA under the Google root

CNA scorecard B 78/100 over 38 records in the last 180 days details

References

1 reference

URL	Tags
https://issuetracker.google.com/440183164

Impacted products

1 product

Vendor	Product	Version
FFmpeg	FFmpeg	Affected: 4d7c609be37dc57d31527c8c9e5945dc9491a7cd , < 8.0 (custom) Affected: 7.1.1 , < 8.0 (semver)

Date Public

2025-08-20 22:00

Credits

Google Big Sleep

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59734",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-08T03:55:15.823380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:48:16.522Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://git.ffmpeg.org/ffmpeg.git",
          "defaultStatus": "unaffected",
          "packageName": "SANM",
          "product": "FFmpeg",
          "repo": "https://git.ffmpeg.org/ffmpeg.git",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThan": "8.0",
              "status": "affected",
              "version": "4d7c609be37dc57d31527c8c9e5945dc9491a7cd",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0",
              "status": "affected",
              "version": "7.1.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google Big Sleep"
        }
      ],
      "datePublic": "2025-08-20T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eIt is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion \u0026lt;2.\u003c/p\u003e\u003cp\u003eWhen a \u003ccode\u003eSTOR\u003c/code\u003e\u0026nbsp;chunk is present, a subsequent \u003ccode\u003eFOBJ\u003c/code\u003e\u0026nbsp;chunk will be saved in \u003ccode\u003ectx-\u0026gt;stored_frame\u003c/code\u003e. Stored frames can later be referenced by \u003ccode\u003eFTCH\u003c/code\u003e\u0026nbsp;chunks. For files using subversion \u0026lt; 2, the undecoded frame is stored, and decoded again when the \u003ccode\u003eFTCH\u003c/code\u003e\u0026nbsp;chunks are parsed.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eHowever, in \u003c/span\u003e\u003ccode\u003eprocess_frame_obj\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;if the frame has an invalid size, there\u2019s an early return, with a value of 0.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThis causes the code in \u003ccode\u003edecode_frame\u003c/code\u003e\u0026nbsp;to still store the raw frame buffer into \u003ccode\u003ectx-\u0026gt;stored_frame\u003c/code\u003e. Leaving \u003ccode\u003ectx-\u0026gt;has_dimensions\u003c/code\u003e\u0026nbsp;set to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eA subsequent chunk with type \u003ccode\u003eFTCH\u003c/code\u003e\u0026nbsp;would call \u003ccode\u003eprocess_ftch\u003c/code\u003e\u0026nbsp;and decode that frame obj again, adding to the top/left values and calling \u003ccode\u003eprocess_frame_obj\u003c/code\u003e\u0026nbsp;again.\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eGiven that we never set \u003c/span\u003e\u003ccode\u003ectx-\u0026gt;have_dimensions\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;before, this time we set the dimensions, calling \u003c/span\u003e\u003ccode\u003einit_buffers\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e, which can reallocate the buffer in \u003c/span\u003e\u003ccode\u003ectx-\u0026gt;stored_frame\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e, freeing the previous one. However, the \u003c/span\u003e\u003ccode\u003eGetByteContext\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;object \u003c/span\u003e\u003ccode\u003egb\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;still holds a reference to the old buffer.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eFinally, when the code tries to decode the frame, codecs that accept a \u003ccode\u003eGetByteContext\u003c/code\u003e\u0026nbsp;as a parameter will trigger a use-after-free read when using \u003ccode\u003egb\u003c/code\u003e.\u003c/p\u003e\u003cp\u003e\u003ccode\u003eGetByteContext\u003c/code\u003e\u0026nbsp;is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the \u003ccode\u003efree\u003c/code\u003e\u0026nbsp;and when the object is accessed. However, upon returning to \u003ccode\u003eprocess_ftch\u003c/code\u003e, the code \u003cem\u003erestores\u003c/em\u003e\u0026nbsp;the original values for top/left in \u003ccode\u003estored_frame\u003c/code\u003e, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator\u2019s metadata.\u003c/p\u003e\u003cp\u003eThis issue can be triggered just by probing whether a file has the sanm format.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003eWe recommend upgrading to version 8.0 or beyond.\u003cp\u003e\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion \u003c2.\n\nWhen a STOR\u00a0chunk is present, a subsequent FOBJ\u00a0chunk will be saved in ctx-\u003estored_frame. Stored frames can later be referenced by FTCH\u00a0chunks. For files using subversion \u003c 2, the undecoded frame is stored, and decoded again when the FTCH\u00a0chunks are parsed.\u00a0However, in process_frame_obj\u00a0if the frame has an invalid size, there\u2019s an early return, with a value of 0.\u00a0\n\nThis causes the code in decode_frame\u00a0to still store the raw frame buffer into ctx-\u003estored_frame. Leaving ctx-\u003ehas_dimensions\u00a0set to false.\n\nA subsequent chunk with type FTCH\u00a0would call process_ftch\u00a0and decode that frame obj again, adding to the top/left values and calling process_frame_obj\u00a0again.\nGiven that we never set ctx-\u003ehave_dimensions\u00a0before, this time we set the dimensions, calling init_buffers, which can reallocate the buffer in ctx-\u003estored_frame, freeing the previous one. However, the GetByteContext\u00a0object gb\u00a0still holds a reference to the old buffer.\n\n\n\n\nFinally, when the code tries to decode the frame, codecs that accept a GetByteContext\u00a0as a parameter will trigger a use-after-free read when using gb.\n\nGetByteContext\u00a0is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the free\u00a0and when the object is accessed. However, upon returning to process_ftch, the code restores\u00a0the original values for top/left in stored_frame, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator\u2019s metadata.\n\nThis issue can be triggered just by probing whether a file has the sanm format.\n\n\n\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-19T14:51:43.143Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://issuetracker.google.com/440183164"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Heap-buffer-overflow write in FFmpeg SANM process_ftch",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2025-59734",
    "datePublished": "2025-10-06T08:09:44.280Z",
    "dateReserved": "2025-09-19T08:11:37.550Z",
    "dateUpdated": "2026-02-26T17:48:16.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted