CVE-2025-59730

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59730", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2025-09-19T08:11:37.550Z", "datePublished": "2025-10-06T08:09:11.029Z", "dateUpdated": "2025-10-06T16:23:59.447Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://git.ffmpeg.org/ffmpeg.git", "defaultStatus": "unaffected", "packageName": "SANM", "product": "FFmpeg", "repo": "https://git.ffmpeg.org/ffmpeg.git", "vendor": "FFmpeg", "versions": [{"lessThan": "8.0", "status": "affected", "version": "829680f96a7a7ff02d1543895ec0fb713309d5c0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Google Big Sleep"}], "datePublic": "2025-07-27T22:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p></p><p>When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.</p><p>Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.</p><p>This codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.</p><p><code>process_frame_obj</code>&nbsp;initializes the buffers based on the frame resolution:</p><p></p>We recommend upgrading to version 8.0 or beyond.<p></p><br>"}], "value": "When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.\n\nFrames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.\n\nThis codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.\n\nprocess_frame_obj\u00a0initializes the buffers based on the frame resolution:\n\n\n\nWe recommend upgrading to version 8.0 or beyond."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 5.7, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-10-06T08:09:11.029Z"}, "references": [{"url": "https://issuetracker.google.com/434637586"}], "source": {"discovery": "EXTERNAL"}, "title": "Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T16:22:19.576410Z", "id": "CVE-2025-59730", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T16:23:59.447Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59730", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T16:22:19.576410Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T16:23:56.062Z"}}], "cna": {"title": "Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Google Big Sleep"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.ffmpeg.org/ffmpeg.git", "vendor": "FFmpeg", "product": "FFmpeg", "versions": [{"status": "affected", "version": "829680f96a7a7ff02d1543895ec0fb713309d5c0", "lessThan": "8.0", "versionType": "custom"}], "packageName": "SANM", "collectionURL": "https://git.ffmpeg.org/ffmpeg.git", "defaultStatus": "unaffected"}], "datePublic": "2025-07-27T22:00:00.000Z", "references": [{"url": "https://issuetracker.google.com/434637586"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.\n\nFrames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.\n\nThis codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.\n\nprocess_frame_obj\u00a0initializes the buffers based on the frame resolution:\n\n\n\nWe recommend upgrading to version 8.0 or beyond.", "supportingMedia": [{"type": "text/html", "value": "<p></p><p></p><p>When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.</p><p>Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.</p><p>This codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.</p><p><code>process_frame_obj</code>&nbsp;initializes the buffers based on the frame resolution:</p><p></p>We recommend upgrading to version 8.0 or beyond.<p></p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-10-06T08:09:11.029Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59730", "state": "PUBLISHED", "dateUpdated": "2025-10-06T16:23:59.447Z", "dateReserved": "2025-09-19T08:11:37.550Z", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "datePublished": "2025-10-06T08:09:11.029Z", "assignerShortName": "Google"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"collectionURL": "https://git.ffmpeg.org/ffmpeg.git", "defaultStatus": "unaffected", "packageName": "SANM", "product": "FFmpeg", "repo": "https://git.ffmpeg.org/ffmpeg.git", "vendor": "FFmpeg", "versions": [{"lessThan": "8.0", "status": "affected", "version": "829680f96a7a7ff02d1543895ec0fb713309d5c0", "versionType": "custom"}]}], "source": "cve-coordination@google.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.\n\nFrames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.\n\nThis codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.\n\nprocess_frame_obj\u00a0initializes the buffers based on the frame resolution:\n\n\n\nWe recommend upgrading to version 8.0 or beyond."}, {"lang": "es", "value": "Al decodificar un fotograma para un archivo SANM (variante ANIM v0), los datos decodificados pueden ser mayores que el b\u00fafer asignado para ellos.\n\nLos fotogramas codificados con el c\u00f3dec 48 pueden especificar su resoluci\u00f3n (ancho x alto). Se asigna un b\u00fafer de tama\u00f1o apropiado dependiendo de la resoluci\u00f3n.\n\nEste c\u00f3dec puede codificar el contenido del fotograma utilizando un algoritmo de codificaci\u00f3n por longitud de ejecuci\u00f3n. No hay comprobaciones de que el fotograma decodificado quepa en el b\u00fafer asignado, lo que lleva a un desbordamiento de b\u00fafer de mont\u00f3n.\n\nprocess_frame_obj inicializa los b\u00faferes bas\u00e1ndose en la resoluci\u00f3n del fotograma:\n\nRecomendamos actualizar a la versi\u00f3n 8.0 o posterior."}], "id": "CVE-2025-59730", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@google.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59730", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T16:22:19.576410Z", "version": "2.0.3"}}]}, "published": "2025-10-06T08:15:34.610", "references": [{"source": "cve-coordination@google.com", "url": "https://issuetracker.google.com/434637586"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{"bugzilla": {"description": "FFmpeg: FFmpeg: Heap-buffer-overflow in SANM (ANIM v0 variant) file frame decoding", "id": "2401802", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401802"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.\nFrames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.\nThis codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.\nprocess_frame_obj\u00a0initializes the buffers based on the frame resolution:\nWe recommend upgrading to version 8.0 or beyond.", "A flaw was found in FFmpeg. This vulnerability allows a heap-buffer-overflow via decoding a SANM (Software Audio and Music, ANIM v0 variant) file frame with run-length encoded data using codec 48, due to insufficient buffer size checks."], "name": "CVE-2025-59730", "public_date": "2025-10-06T08:09:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-59730\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59730\nhttps://issuetracker.google.com/434637586"], "statement": "This flaw in FFmpeg can lead to a heap-buffer-overflow when processing a specially crafted SANM (ANIM v0 variant) file. The highest threat is to system availability, as an attacker on the same adjacent network could trigger a denial of service.", "threat_severity": "Moderate"}

{"created": "2025-10-06T14:39:54.156369+00:00", "updated": "2025-10-06T14:39:54.156483+00:00", "vendors": ["ffmpeg", "ffmpeg$PRODUCT$ffmpeg"]}