Medium severity · published Oct 6, 2025
CVE-2025-59730
Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48
5.7
CVSS
0.2%
EPSS
No
On KEV
Description
When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.
Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.
This codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.
process_frame_obj initializes the buffers based on the frame resolution:
We recommend upgrading to version 8.0 or beyond.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
FFmpeg · FFmpeg
829680f96a7a7ff02d1543895ec0fb713309d5c0 before 8.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59730
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59730
issuetracker.google.com
https://issuetracker.google.com/434637586
More from FFmpeg
9.8
CVE-2026-75143
FFmpeg Heap Buffer Overflow via RIST Protocol Reader
9.8
CVE-2026-40962
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c
9.8
CVE-2024-35368
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c
9.8
CVE-2024-31581
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c
9.8
CVE-2024-22862
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser
