10831 matches found
CVE-2025-59734 Heap-buffer-overflow write in FFmpeg SANM process_ftch
It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion storedframe. Stored frames can later be referenced by FTCH chunks. For files using subversion storedframe. Leaving ctx-hasdimensions set to false. A subsequent chunk with type...
CVE-2025-59733 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress
When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type and size, and that if there are four channels, the first four are "B", "G", "R" and "A". The channel parsing code can be found in decodeheader. The...
CVE-2025-59732 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress
When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at 0 and 1 will continue to write until the next multiple of 8. The buffer...
CVE-2025-59732 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress
When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at 0 and 1 will continue to write until the next multiple of 8. The buffer...
CVE-2025-59731 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...
CVE-2025-59731 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...
CVE-2025-59730 Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48
When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...
CVE-2025-59730 Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48
When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...
CVE-2025-59729 Heap-buffer-overflow read in FFmpeg DHAV get_duration
When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAXDURATIONBUFFERSIZE bytes 0x100000 for example 0x101000 bytes, then at 0 we ha...
CVE-2025-59729 Heap-buffer-overflow read in FFmpeg DHAV get_duration
When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAXDURATIONBUFFERSIZE bytes 0x100000 for example 0x101000 bytes, then at 0 we ha...
CVE-2025-59728 Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path
When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below 0, it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is...
CVE-2025-59728 Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path
When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below 0, it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is...
ffmpeg:ffmpeg_AV_CODEC_ID_VVC_fuzzer: Use-of-uninitialized-value in ff_vvc_coding_tree_unit
Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5600497089445888 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDVVCfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...
FFmpeg 安全漏洞
FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg team. A security vulnerability exists in FFmpeg versions prior to 8.0, which stems from decoding frames without checking if the decoded data exceeds the allocated buffer, potentially resulting i...
The vulnerability of the FFmpeg multimedia library, related to integer overflows, allows attackers to cause service failures.
The vulnerability of the FFmpeg multimedia library is related to a numerical overflow condition. Exploiting this vulnerability allows a remote attacker to cause a service failure...
The vulnerability of the `link_filter_inouts` function in the `libavfilter/graphparser.c` component of the FFmpeg multimedia library allows a hacker to induce a service failure.
The vulnerability of the linkfilterinouts function in the libavfilter/graphparser.c file of the FFmpeg multimedia library relates to improper memory release before deleting the last reference. Exploiting this vulnerability allows an attacker to cause a service failure...
The vulnerability of the fifo_alloc_common function in the libavutil/fifo.c component of the FFmpeg multimedia library allows a attacker to cause a service failure.
The vulnerability of the fifoalloccommon function in the libavutil/fifo.c component of the FFmpeg multimedia library relates to improper memory release before deleting the last reference. Exploiting this vulnerability allows an attacker to cause service failure...
FFmpeg 安全漏洞
ffmpeg is a rust library by meh.individual developer. A security vulnerability exists in versions of FFmpeg prior to 8.0, which stems from an integer underflow when parsing a DHAV file header, which may result in a duration before reading the allocation buffer...
