https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T23:15:05.808567+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-59731 CVE-2025-59731 — Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress 2026-09-28T23:15:05.810160+00:00

Affected: FFmpeg

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.

We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.

We recommend upgrading to version 8.0 or beyond.