CVE-2025-59729 Heap-buffer-overflow read in FFmpeg DHAV get_duration
An integer underflow in FFmpeg's DHAV parser allows heap buffer over-reads, potentially leading to code execution or crashes when processing malicious files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-59729?
CVE-2025-59729 is a medium-severity vulnerability in FFmpeg, published on 6 Oct 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer.
If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have end_buffer_size = 0x100000, and at [2] we have end_buffer_pos = 0x1000.
The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we'll calculate end_pos based on a 32-bit offset read from the buffer.
There is subsequently a check [3] that end_pos is within the section of the file that has been copied into end_buffer, but it only correctly handles the cases where end_pos is before the start of the file or after the section copied into end_buffer, and not the case where end_pos is within the the file, but before the section copied into end_buffer. If we provide such an offset, (end_pos - end_buffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation.
We recommend upgrading to version 8.0 or beyond.
Weakness: CWE-787
Which versions are affected by CVE-2025-59729?
How do I fix CVE-2025-59729?
No fix has been published for CVE-2025-59729 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-59729 being exploited?
There is no known exploitation of CVE-2025-59729 in the wild and no public exploit code.
Sources
Also known as GHSA-j8h4-v947-5h7q, MINI-rrcg-j97p-747v, UBUNTU-CVE-2025-59729.