CVE-2025-59732
Fixed in a distro release EPSS <1%CVSS 8.7
When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at [0] and [1] will continue to write until the next multiple of 8. The buffer td->uncompressed_data is allocated in decode_block based on the precise height and width of the image, so the "rounded-up" multiple of 8 in the copy loop can exceed the buffer bounds, and the write block starting at [2] can corrupt following heap memory. We recommend upgrading to version 8.0 or beyond.
Products: FFMPEG
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-python-ffmpeg-7-minimal | no fix |
| Chainguard | eco-python-ffmpeg-7-minimal-dev | no fix |
| Chainguard | eco-python-ffmpeg-7-minimal-static | no fix |
| Chainguard | ffmpeg-7 | no fix |
| Chainguard | ffmpeg-7-dev | 7.1.2-r0 |
| Chainguard | ffmpeg-7-doc | 7.1.2-r0 |
| Chainguard | ffmpeg-7-libavcodec61 | 7.1.2-r0 |
| Chainguard | ffmpeg-7-libavdevice61 | 7.1.2-r0 |
| Chainguard | ffmpeg-7-libavfilter10 | 7.1.2-r0 |
| Chainguard | ffmpeg-7-libavformat61 | 7.1.2-r0 |
| Chainguard | ffmpeg-7-libavutil59 | 7.1.2-r0 |
| Chainguard | ffmpeg-7-libpostproc58 | 7.1.2-r0 |
| Chainguard | ffmpeg-7-libswresample5 | 7.1.2-r0 |
| Chainguard | ffmpeg-7-libswscale8 | 7.1.2-r0 |
| Chainguard | ffmpeg-7-qt-faststart | 7.1.2-r0 |
| Chainguard | ffmpeg-7-static | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1 | no fix |
| Chainguard | ffmpeg-7.1-dev | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-doc | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavcodec61 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavdevice61 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavfilter10 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavformat61 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libavutil59 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libpostproc58 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libswresample5 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-libswscale8 | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-qt-faststart | 7.1.2-r0 |
| Chainguard | ffmpeg-7.1-static | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-dev | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-libavcodec61 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-libavdevice61 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-libavfilter10 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-libavformat61 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-libavutil59 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-libpostproc58 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-libswresample5 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-libswscale8 | 7.1.2-r0 |
| Chainguard | ffmpeg-fips-7.1-static | 7.1.2-r0 |
| Debian 12 | ffmpeg | 7:5.1.7-0+deb12u1 |
| Debian 13 | ffmpeg | 7:7.1.2-0+deb13u1 |
| Debian 14 | ffmpeg | 7:7.1.2-1 |
| Ubuntu 25.10 | ffmpeg | 7:7.1.1-1ubuntu4.2 |
| Ubuntu Pro 14.04 LTS | libav | no fix |
| Ubuntu Pro 16.04 LTS | ffmpeg | 7:2.8.17-0ubuntu0.1+esm14 |
| Ubuntu Pro 18.04 LTS | ffmpeg | 7:3.4.11-0ubuntu0.1+esm12 |
| Ubuntu Pro 20.04 LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm12 |
| Ubuntu Pro 22.04 LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm11 |
| Ubuntu Pro 24.04 LTS | ffmpeg | 7:6.1.1-3ubuntu5+esm7 |
| Wolfi | ffmpeg-7 | no fix |
| Wolfi | ffmpeg-7-dev | 7.1.2-r0 |
| Wolfi | ffmpeg-7-doc | 7.1.2-r0 |
| Wolfi | ffmpeg-7-libavcodec61 | 7.1.2-r0 |
| Wolfi | ffmpeg-7-libavdevice61 | 7.1.2-r0 |
| Wolfi | ffmpeg-7-libavfilter10 | 7.1.2-r0 |
| Wolfi | ffmpeg-7-libavformat61 | 7.1.2-r0 |
| Wolfi | ffmpeg-7-libavutil59 | 7.1.2-r0 |
| Wolfi | ffmpeg-7-libpostproc58 | 7.1.2-r0 |
| Wolfi | ffmpeg-7-libswresample5 | 7.1.2-r0 |
| Wolfi | ffmpeg-7-libswscale8 | 7.1.2-r0 |
| Wolfi | ffmpeg-7-qt-faststart | 7.1.2-r0 |
| Wolfi | ffmpeg-7-static | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1 | no fix |
| Wolfi | ffmpeg-7.1-dev | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-doc | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavcodec61 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavdevice61 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavfilter10 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavformat61 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libavutil59 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libpostproc58 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libswresample5 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-libswscale8 | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-qt-faststart | 7.1.2-r0 |
| Wolfi | ffmpeg-7.1-static | 7.1.2-r0 |