Medium severityNVD Advisory· Published Oct 6, 2025· Updated Apr 15, 2026
CVE-2025-59730
CVE-2025-59730
Description
When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.
Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.
This codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.
process_frame_obj initializes the buffers based on the frame resolution:
We recommend upgrading to version 8.0 or beyond.
Affected products
60- osv-coords60 versionspkg:apk/chainguard/ffmpeg-6-devpkg:apk/chainguard/ffmpeg-6-docpkg:apk/chainguard/ffmpeg-6-libavcodec61pkg:apk/chainguard/ffmpeg-6-libavdevice61pkg:apk/chainguard/ffmpeg-6-libavfilter10pkg:apk/chainguard/ffmpeg-6-libavformat61pkg:apk/chainguard/ffmpeg-6-libavutil59pkg:apk/chainguard/ffmpeg-6-libpostproc58pkg:apk/chainguard/ffmpeg-6-libswresample5pkg:apk/chainguard/ffmpeg-6-libswscale8pkg:apk/chainguard/ffmpeg-6-qt-faststartpkg:apk/chainguard/ffmpeg-6-staticpkg:apk/chainguard/ffmpeg-7.1-devpkg:apk/chainguard/ffmpeg-7.1-docpkg:apk/chainguard/ffmpeg-7.1-libavcodec61pkg:apk/chainguard/ffmpeg-7.1-libavdevice61pkg:apk/chainguard/ffmpeg-7.1-libavfilter10pkg:apk/chainguard/ffmpeg-7.1-libavformat61pkg:apk/chainguard/ffmpeg-7.1-libavutil59pkg:apk/chainguard/ffmpeg-7.1-libpostproc58pkg:apk/chainguard/ffmpeg-7.1-libswresample5pkg:apk/chainguard/ffmpeg-7.1-libswscale8pkg:apk/chainguard/ffmpeg-7.1-qt-faststartpkg:apk/chainguard/ffmpeg-7.1-staticpkg:apk/chainguard/ffmpeg-7-devpkg:apk/chainguard/ffmpeg-7-docpkg:apk/chainguard/ffmpeg-7-libavcodec61pkg:apk/chainguard/ffmpeg-7-libavdevice61pkg:apk/chainguard/ffmpeg-7-libavfilter10pkg:apk/chainguard/ffmpeg-7-libavformat61pkg:apk/chainguard/ffmpeg-7-libavutil59pkg:apk/chainguard/ffmpeg-7-libpostproc58pkg:apk/chainguard/ffmpeg-7-libswresample5pkg:apk/chainguard/ffmpeg-7-libswscale8pkg:apk/chainguard/ffmpeg-7-qt-faststartpkg:apk/chainguard/ffmpeg-7-staticpkg:apk/wolfi/ffmpeg-7.1-devpkg:apk/wolfi/ffmpeg-7.1-docpkg:apk/wolfi/ffmpeg-7.1-libavcodec61pkg:apk/wolfi/ffmpeg-7.1-libavdevice61pkg:apk/wolfi/ffmpeg-7.1-libavfilter10pkg:apk/wolfi/ffmpeg-7.1-libavformat61pkg:apk/wolfi/ffmpeg-7.1-libavutil59pkg:apk/wolfi/ffmpeg-7.1-libpostproc58pkg:apk/wolfi/ffmpeg-7.1-libswresample5pkg:apk/wolfi/ffmpeg-7.1-libswscale8pkg:apk/wolfi/ffmpeg-7.1-qt-faststartpkg:apk/wolfi/ffmpeg-7.1-staticpkg:apk/wolfi/ffmpeg-7-devpkg:apk/wolfi/ffmpeg-7-docpkg:apk/wolfi/ffmpeg-7-libavcodec61pkg:apk/wolfi/ffmpeg-7-libavdevice61pkg:apk/wolfi/ffmpeg-7-libavfilter10pkg:apk/wolfi/ffmpeg-7-libavformat61pkg:apk/wolfi/ffmpeg-7-libavutil59pkg:apk/wolfi/ffmpeg-7-libpostproc58pkg:apk/wolfi/ffmpeg-7-libswresample5pkg:apk/wolfi/ffmpeg-7-libswscale8pkg:apk/wolfi/ffmpeg-7-qt-faststartpkg:apk/wolfi/ffmpeg-7-static
< 6.1.4-r0+ 59 more
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 6.1.4-r0
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r1
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
- (no CPE)range: < 7.1.3-r0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.