{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59734", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2025-09-19T08:11:37.550Z", "datePublished": "2025-10-06T08:09:44.280Z", "dateUpdated": "2025-10-06T08:09:44.280Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://git.ffmpeg.org/ffmpeg.git", "defaultStatus": "unaffected", "packageName": "SANM", "product": "FFmpeg", "repo": "https://git.ffmpeg.org/ffmpeg.git", "vendor": "FFmpeg", "versions": [{"lessThan": "8.0", "status": "affected", "version": "4d7c609be37dc57d31527c8c9e5945dc9491a7cd", "versionType": "custom"}, {"lessThan": "8.0", "status": "affected", "version": "7.1.1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Google Big Sleep"}], "datePublic": "2025-08-20T22:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p></p><p></p><p></p><p></p><p>It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion &lt;2.</p><p>When a <code>STOR</code>&nbsp;chunk is present, a subsequent <code>FOBJ</code>&nbsp;chunk will be saved in <code>ctx-&gt;stored_frame</code>. Stored frames can later be referenced by <code>FTCH</code>&nbsp;chunks. For files using subversion &lt; 2, the undecoded frame is stored, and decoded again when the <code>FTCH</code>&nbsp;chunks are parsed.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">However, in </span><code>process_frame_obj</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;if the frame has an invalid size, there\u2019s an early return, with a value of 0.&nbsp;</span></p><p>This causes the code in <code>decode_frame</code>&nbsp;to still store the raw frame buffer into <code>ctx-&gt;stored_frame</code>. Leaving <code>ctx-&gt;has_dimensions</code>&nbsp;set to <code>false</code>.</p><p>A subsequent chunk with type <code>FTCH</code>&nbsp;would call <code>process_ftch</code>&nbsp;and decode that frame obj again, adding to the top/left values and calling <code>process_frame_obj</code>&nbsp;again.<br><span style=\"background-color: rgb(255, 255, 255);\">Given that we never set </span><code>ctx-&gt;have_dimensions</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;before, this time we set the dimensions, calling </span><code>init_buffers</code><span style=\"background-color: rgb(255, 255, 255);\">, which can reallocate the buffer in </span><code>ctx-&gt;stored_frame</code><span style=\"background-color: rgb(255, 255, 255);\">, freeing the previous one. However, the </span><code>GetByteContext</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;object </span><code>gb</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;still holds a reference to the old buffer.</span><br></p><p></p><p>Finally, when the code tries to decode the frame, codecs that accept a <code>GetByteContext</code>&nbsp;as a parameter will trigger a use-after-free read when using <code>gb</code>.</p><p><code>GetByteContext</code>&nbsp;is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the <code>free</code>&nbsp;and when the object is accessed. However, upon returning to <code>process_ftch</code>, the code <em>restores</em>&nbsp;the original values for top/left in <code>stored_frame</code>, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator\u2019s metadata.</p><p>This issue can be triggered just by probing whether a file has the sanm format.</p><p></p><p></p><p></p>We recommend upgrading to version 8.0 or beyond.<p></p><br>"}], "value": "It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2.\n\nWhen a STOR\u00a0chunk is present, a subsequent FOBJ\u00a0chunk will be saved in ctx->stored_frame. Stored frames can later be referenced by FTCH\u00a0chunks. For files using subversion < 2, the undecoded frame is stored, and decoded again when the FTCH\u00a0chunks are parsed.\u00a0However, in process_frame_obj\u00a0if the frame has an invalid size, there\u2019s an early return, with a value of 0.\u00a0\n\nThis causes the code in decode_frame\u00a0to still store the raw frame buffer into ctx->stored_frame. Leaving ctx->has_dimensions\u00a0set to false.\n\nA subsequent chunk with type FTCH\u00a0would call process_ftch\u00a0and decode that frame obj again, adding to the top/left values and calling process_frame_obj\u00a0again.\nGiven that we never set ctx->have_dimensions\u00a0before, this time we set the dimensions, calling init_buffers, which can reallocate the buffer in ctx->stored_frame, freeing the previous one. However, the GetByteContext\u00a0object gb\u00a0still holds a reference to the old buffer.\n\n\n\n\nFinally, when the code tries to decode the frame, codecs that accept a GetByteContext\u00a0as a parameter will trigger a use-after-free read when using gb.\n\nGetByteContext\u00a0is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the free\u00a0and when the object is accessed. However, upon returning to process_ftch, the code restores\u00a0the original values for top/left in stored_frame, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator\u2019s metadata.\n\nThis issue can be triggered just by probing whether a file has the sanm format.\n\n\n\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-10-06T08:09:44.280Z"}, "references": [{"url": "https://b.corp.google.com/issues/440183164"}], "source": {"discovery": "EXTERNAL"}, "title": "Heap-buffer-overflow write in FFmpeg SANM process_ftch", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2.\n\nWhen a STOR\u00a0chunk is present, a subsequent FOBJ\u00a0chunk will be saved in ctx->stored_frame. Stored frames can later be referenced by FTCH\u00a0chunks. For files using subversion < 2, the undecoded frame is stored, and decoded again when the FTCH\u00a0chunks are parsed.\u00a0However, in process_frame_obj\u00a0if the frame has an invalid size, there\u2019s an early return, with a value of 0.\u00a0\n\nThis causes the code in decode_frame\u00a0to still store the raw frame buffer into ctx->stored_frame. Leaving ctx->has_dimensions\u00a0set to false.\n\nA subsequent chunk with type FTCH\u00a0would call process_ftch\u00a0and decode that frame obj again, adding to the top/left values and calling process_frame_obj\u00a0again.\nGiven that we never set ctx->have_dimensions\u00a0before, this time we set the dimensions, calling init_buffers, which can reallocate the buffer in ctx->stored_frame, freeing the previous one. However, the GetByteContext\u00a0object gb\u00a0still holds a reference to the old buffer.\n\n\n\n\nFinally, when the code tries to decode the frame, codecs that accept a GetByteContext\u00a0as a parameter will trigger a use-after-free read when using gb.\n\nGetByteContext\u00a0is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the free\u00a0and when the object is accessed. However, upon returning to process_ftch, the code restores\u00a0the original values for top/left in stored_frame, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator\u2019s metadata.\n\nThis issue can be triggered just by probing whether a file has the sanm format.\n\n\n\n\n\n\n\nWe recommend upgrading to version 8.0 or beyond."}], "id": "CVE-2025-59734", "lastModified": "2025-10-06T08:15:35.227", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@google.com", "type": "Secondary"}]}, "published": "2025-10-06T08:15:35.227", "references": [{"source": "cve-coordination@google.com", "url": "https://b.corp.google.com/issues/440183164"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{}

{}