Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-936094)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936094 advisory. A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifoalloccommon function in libavutil/fifo.c. Tenable has extracted the preceding...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2025-936103)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936103 advisory. A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vfvmafmotion.c in convolutiony8bit, which could let a remote malicious user cause a Denia...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2025-936088)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936088 advisory. A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avdictset function in dict.c. Tenable has extracted the preceding description bloc...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2025-936078)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936078 advisory. A CWE-125: Out-of-bounds read vulnerability exists in longtermfilter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-936104)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936104 advisory. A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vfedgedetect.c in gaussianblur, which might lead to memory corruption and other potential...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-936086)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936086 advisory. A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code. Tenable has extracted the preceding...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2025-936083)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936083 advisory. Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnnexecutelayerpad in libavfilter/dnn/dnnbackendnativelayerpad.c due to a call to memcpy without length checks, whic...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-936097)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936097 advisory. A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the vframealloc function in frame.c. Tenable has extracted the preceding description...

CVE-2025-59734 Heap-buffer-overflow write in FFmpeg SANM process_ftch

It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion storedframe. Stored frames can later be referenced by FTCH chunks. For files using subversion storedframe. Leaving ctx-hasdimensions set to false. A subsequent chunk with type...

CVE-2025-59733 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type and size, and that if there are four channels, the first four are "B", "G", "R" and "A". The channel parsing code can be found in decodeheader. The...

CVE-2025-59732 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at 0 and 1 will continue to write until the next multiple of 8. The buffer...

CVE-2025-59732 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at 0 and 1 will continue to write until the next multiple of 8. The buffer...

CVE-2025-59731 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...

CVE-2025-59731 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...

CVE-2025-59730 Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48

When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...

CVE-2025-59730 Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48

When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...

CVE-2025-59729 Heap-buffer-overflow read in FFmpeg DHAV get_duration

When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAXDURATIONBUFFERSIZE bytes 0x100000 for example 0x101000 bytes, then at 0 we ha...

CVE-2025-59729 Heap-buffer-overflow read in FFmpeg DHAV get_duration

When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAXDURATIONBUFFERSIZE bytes 0x100000 for example 0x101000 bytes, then at 0 we ha...

CVE-2025-59728 Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below 0, it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is...

CVE-2025-59728 Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below 0, it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is...