Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-936096)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936096 advisory. A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avbuffersrcaddframeflags function in buffersrc. Tenable has extracted the precedin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-869070)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-869070 advisory. FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-936077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936077 advisory. Integer Overflow vulnerability in function filter16roberts in libavfilter/vfconvolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-936082)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936082 advisory. Buffer Overflow vulnerability in function configinput in libavfilter/vfgblur.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified...

CVE-2025-59734 Heap-buffer-overflow write in FFmpeg SANM process_ftch

It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion storedframe. Stored frames can later be referenced by FTCH chunks. For files using subversion storedframe. Leaving ctx-hasdimensions set to false. A subsequent chunk with type...

CVE-2025-59733 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type and size, and that if there are four channels, the first four are "B", "G", "R" and "A". The channel parsing code can be found in decodeheader. The...

CVE-2025-59732 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at 0 and 1 will continue to write until the next multiple of 8. The buffer...

CVE-2025-59732 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at 0 and 1 will continue to write until the next multiple of 8. The buffer...

CVE-2025-59731 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...

CVE-2025-59731 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...

CVE-2025-59730 Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48

When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...

CVE-2025-59730 Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48

When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...

CVE-2025-59729 Heap-buffer-overflow read in FFmpeg DHAV get_duration

When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAXDURATIONBUFFERSIZE bytes 0x100000 for example 0x101000 bytes, then at 0 we ha...

CVE-2025-59729 Heap-buffer-overflow read in FFmpeg DHAV get_duration

When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAXDURATIONBUFFERSIZE bytes 0x100000 for example 0x101000 bytes, then at 0 we ha...

CVE-2025-59728 Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below 0, it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is...

CVE-2025-59728 Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below 0, it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is...

ffmpeg:ffmpeg_AV_CODEC_ID_VVC_fuzzer: Use-of-uninitialized-value in ff_vvc_coding_tree_unit

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5600497089445888 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDVVCfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

FFmpeg 安全漏洞

FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg team. A security vulnerability exists in FFmpeg versions prior to 8.0, which stems from decoding frames without checking if the decoded data exceeds the allocated buffer, potentially resulting i...

FFmpeg 安全漏洞

ffmpeg is a rust library by meh.individual developer. A security vulnerability exists in versions of FFmpeg prior to 8.0, which stems from an integer underflow when parsing a DHAV file header, which may result in a duration before reading the allocation buffer...

The vulnerability of the FFmpeg multimedia library, related to integer overflows, allows attackers to cause service failures.

The vulnerability of the FFmpeg multimedia library is related to a numerical overflow condition. Exploiting this vulnerability allows a remote attacker to cause a service failure...