CVE-2025-59730
Description
When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow. process_frame_obj initializes the buffers based on the frame resolution: We recommend upgrading to version 8.0 or beyond.
How to fix
- FFmpeg FFmpeg8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| FFmpeg FFmpeg | 829680f96a7a7ff02d1543895ec0fb713309d5c0 ≤ v < 8.0 | 8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.