CVE-2025-59728

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-59728", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2025-09-19T08:11:37.549Z", "datePublished": "2025-10-06T08:08:27.410Z", "dateUpdated": "2026-02-26T17:48:18.443Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://git.ffmpeg.org/ffmpeg.git", "defaultStatus": "unaffected", "product": "MPEG-DASH", "repo": "https://git.ffmpeg.org/ffmpeg.git", "vendor": "FFmpeg", "versions": [{"lessThan": "8.0", "status": "affected", "version": "7.1.1", "versionType": "semver"}, {"lessThan": "8.0", "status": "affected", "version": "a218cafe4d3be005ab0c61130f90db4d21afb5db", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Google Big Sleep"}], "datePublic": "2025-07-21T22:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call <code>xmlNodeGetContent</code>&nbsp;below [0], it returns a buffer precisely allocated to match the string length, using <code>strdup</code>&nbsp;internally. If this buffer is not an empty string, it is assigned to <code>root_url</code>&nbsp;at [1].If the last (non-NUL) byte in this buffer is not <code>'/'</code>&nbsp;then we append <code>'/'</code>&nbsp;in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.<br>We recommend upgrading to version 8.0 or beyond.</p><br>"}], "value": "When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent\u00a0below [0], it returns a buffer precisely allocated to match the string length, using strdup\u00a0internally. If this buffer is not an empty string, it is assigned to root_url\u00a0at [1].If the last (non-NUL) byte in this buffer is not '/'\u00a0then we append '/'\u00a0in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\nWe recommend upgrading to version 8.0 or beyond."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-10-06T08:08:27.410Z"}, "references": [{"url": "https://issuetracker.google.com/433502298"}], "source": {"discovery": "EXTERNAL"}, "title": "Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59728", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-08T03:55:09.505657Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:48:18.443Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59728", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-08T03:55:09.505657Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T16:30:35.794Z"}}], "cna": {"title": "Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Google Big Sleep"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.ffmpeg.org/ffmpeg.git", "vendor": "FFmpeg", "product": "MPEG-DASH", "versions": [{"status": "affected", "version": "7.1.1", "lessThan": "8.0", "versionType": "semver"}, {"status": "affected", "version": "a218cafe4d3be005ab0c61130f90db4d21afb5db", "lessThan": "8.0", "versionType": "custom"}], "collectionURL": "https://git.ffmpeg.org/ffmpeg.git", "defaultStatus": "unaffected"}], "datePublic": "2025-07-21T22:00:00.000Z", "references": [{"url": "https://issuetracker.google.com/433502298"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent\u00a0below [0], it returns a buffer precisely allocated to match the string length, using strdup\u00a0internally. If this buffer is not an empty string, it is assigned to root_url\u00a0at [1].If the last (non-NUL) byte in this buffer is not '/'\u00a0then we append '/'\u00a0in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\nWe recommend upgrading to version 8.0 or beyond.", "supportingMedia": [{"type": "text/html", "value": "<p>When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call <code>xmlNodeGetContent</code>&nbsp;below [0], it returns a buffer precisely allocated to match the string length, using <code>strdup</code>&nbsp;internally. If this buffer is not an empty string, it is assigned to <code>root_url</code>&nbsp;at [1].If the last (non-NUL) byte in this buffer is not <code>'/'</code>&nbsp;then we append <code>'/'</code>&nbsp;in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.<br>We recommend upgrading to version 8.0 or beyond.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-10-06T08:08:27.410Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59728", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:48:18.443Z", "dateReserved": "2025-09-19T08:11:37.549Z", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "datePublished": "2025-10-06T08:08:27.410Z", "assignerShortName": "Google"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://git.ffmpeg.org/ffmpeg.git", "defaultStatus": "unaffected", "product": "MPEG-DASH", "repo": "https://git.ffmpeg.org/ffmpeg.git", "vendor": "FFmpeg", "versions": [{"lessThan": "8.0", "status": "affected", "version": "7.1.1", "versionType": "semver"}, {"lessThan": "8.0", "status": "affected", "version": "a218cafe4d3be005ab0c61130f90db4d21afb5db", "versionType": "custom"}]}], "source": "cve-coordination@google.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent\u00a0below [0], it returns a buffer precisely allocated to match the string length, using strdup\u00a0internally. If this buffer is not an empty string, it is assigned to root_url\u00a0at [1].If the last (non-NUL) byte in this buffer is not '/'\u00a0then we append '/'\u00a0in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\nWe recommend upgrading to version 8.0 or beyond."}, {"lang": "es", "value": "Al calcular la ruta de contenido al manejar manifiestos MPEG-DASH, se produce una escritura de byte NUL fuera de l\u00edmites un byte m\u00e1s all\u00e1 del final del b\u00fafer. Cuando se llama a xmlNodeGetContent a continuaci\u00f3n [0], devuelve un b\u00fafer asignado con precisi\u00f3n para coincidir con la longitud de la cadena, utilizando strdup internamente. Si este b\u00fafer no es una cadena vac\u00eda, se asigna a root_url en [1]. Si el \u00faltimo byte (no NUL) en este b\u00fafer no es /, entonces se a\u00f1ade / en el mismo lugar en [2]. Esto escribir\u00e1 dos bytes en el b\u00fafer, comenzando en el \u00faltimo byte v\u00e1lido en el b\u00fafer, escribiendo el byte NUL m\u00e1s all\u00e1 del final del b\u00fafer asignado.\nRecomendamos actualizar a la versi\u00f3n 8.0 o posterior."}], "id": "CVE-2025-59728", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@google.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59728", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-08T03:55:09.505657Z", "version": "2.0.3"}}]}, "published": "2025-10-06T08:15:34.220", "references": [{"source": "cve-coordination@google.com", "url": "https://issuetracker.google.com/433502298"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{"bugzilla": {"description": "FFmpeg: FFmpeg: Out-of-bounds NUL-byte write in MPEG-DASH manifest handling", "id": "2401803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401803"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent\u00a0below [0], it returns a buffer precisely allocated to match the string length, using strdup\u00a0internally. If this buffer is not an empty string, it is assigned to root_url\u00a0at [1].If the last (non-NUL) byte in this buffer is not '/'\u00a0then we append '/'\u00a0in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\nWe recommend upgrading to version 8.0 or beyond.", "A flaw was found in FFmpeg. This vulnerability allows an out-of-bounds NUL-byte write one byte past the end of the buffer, leading to potential denial of service or arbitrary code execution, via the processing of a specially crafted MPEG-DASH (Dynamic Adaptive Streaming over HTTP) manifest."], "name": "CVE-2025-59728", "public_date": "2025-10-06T08:08:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-59728\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59728\nhttps://issuetracker.google.com/433502298"], "statement": "The highest threat to Red Hat products is to system availability, as processing a specially crafted MPEG-DASH manifest can lead to a denial of service.", "threat_severity": "Important"}

{"created": "2025-10-06T14:39:59.156505+00:00", "updated": "2025-10-06T14:39:59.156602+00:00", "vendors": ["ffmpeg", "ffmpeg$PRODUCT$ffmpeg"]}