CVE-2025-59728 (GCVE-0-2025-59728)

Vulnerability from cvelistv5 – Published: 2025-10-06 08:08 – Updated: 2026-02-26 17:48
VLAI
Title
Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path
Summary
When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below [0], it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is not an empty string, it is assigned to root_url at [1].If the last (non-NUL) byte in this buffer is not '/' then we append '/' in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer. We recommend upgrading to version 8.0 or beyond.
Severity
8.7 (High)
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-08 03:55 UTC
CWE
Assigner
Google CNA under the Google root
CNA scorecard C 75/100 over 34 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
FFmpeg MPEG-DASH Affected: 7.1.1 , < 8.0 (semver)
Affected: a218cafe4d3be005ab0c61130f90db4d21afb5db , < 8.0 (custom)
guessed Create a notification for this product.
Date Public
2025-07-21 22:00
Credits
Google Big Sleep
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59728",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-08T03:55:09.505657Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:48:18.443Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://git.ffmpeg.org/ffmpeg.git",
          "defaultStatus": "unaffected",
          "product": "MPEG-DASH",
          "repo": "https://git.ffmpeg.org/ffmpeg.git",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThan": "8.0",
              "status": "affected",
              "version": "7.1.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.0",
              "status": "affected",
              "version": "a218cafe4d3be005ab0c61130f90db4d21afb5db",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google Big Sleep"
        }
      ],
      "datePublic": "2025-07-21T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhen calculating the content path in handling of MPEG-DASH manifests, there\u0027s an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call \u003ccode\u003exmlNodeGetContent\u003c/code\u003e\u0026nbsp;below [0], it returns a buffer precisely allocated to match the string length, using \u003ccode\u003estrdup\u003c/code\u003e\u0026nbsp;internally. If this buffer is not an empty string, it is assigned to \u003ccode\u003eroot_url\u003c/code\u003e\u0026nbsp;at [1].If the last (non-NUL) byte in this buffer is not \u003ccode\u003e\u0027/\u0027\u003c/code\u003e\u0026nbsp;then we append \u003ccode\u003e\u0027/\u0027\u003c/code\u003e\u0026nbsp;in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\u003cbr\u003eWe recommend upgrading to version 8.0 or beyond.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "When calculating the content path in handling of MPEG-DASH manifests, there\u0027s an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent\u00a0below [0], it returns a buffer precisely allocated to match the string length, using strdup\u00a0internally. If this buffer is not an empty string, it is assigned to root_url\u00a0at [1].If the last (non-NUL) byte in this buffer is not \u0027/\u0027\u00a0then we append \u0027/\u0027\u00a0in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\nWe recommend upgrading to version 8.0 or beyond."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-06T08:08:27.410Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://issuetracker.google.com/433502298"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2025-59728",
    "datePublished": "2025-10-06T08:08:27.410Z",
    "dateReserved": "2025-09-19T08:11:37.549Z",
    "dateUpdated": "2026-02-26T17:48:18.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-59728",
      "date": "2026-10-10",
      "epss": "0.00186",
      "percentile": "0.07503"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://git.ffmpeg.org/ffmpeg.git",
                "defaultStatus": "unaffected",
                "product": "MPEG-DASH",
                "repo": "https://git.ffmpeg.org/ffmpeg.git",
                "vendor": "FFmpeg",
                "versions": [
                  {
                    "lessThan": "8.0",
                    "status": "affected",
                    "version": "7.1.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.0",
                    "status": "affected",
                    "version": "a218cafe4d3be005ab0c61130f90db4d21afb5db",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "cve-coordination@google.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "When calculating the content path in handling of MPEG-DASH manifests, there\u0027s an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent\u00a0below [0], it returns a buffer precisely allocated to match the string length, using strdup\u00a0internally. If this buffer is not an empty string, it is assigned to root_url\u00a0at [1].If the last (non-NUL) byte in this buffer is not \u0027/\u0027\u00a0then we append \u0027/\u0027\u00a0in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\nWe recommend upgrading to version 8.0 or beyond."
          },
          {
            "lang": "es",
            "value": "Al calcular la ruta de contenido al manejar manifiestos MPEG-DASH, se produce una escritura de byte NUL fuera de l\u00edmites un byte m\u00e1s all\u00e1 del final del b\u00fafer. Cuando se llama a xmlNodeGetContent a continuaci\u00f3n [0], devuelve un b\u00fafer asignado con precisi\u00f3n para coincidir con la longitud de la cadena, utilizando strdup internamente. Si este b\u00fafer no es una cadena vac\u00eda, se asigna a root_url en [1]. Si el \u00faltimo byte (no NUL) en este b\u00fafer no es /, entonces se a\u00f1ade / en el mismo lugar en [2]. Esto escribir\u00e1 dos bytes en el b\u00fafer, comenzando en el \u00faltimo byte v\u00e1lido en el b\u00fafer, escribiendo el byte NUL m\u00e1s all\u00e1 del final del b\u00fafer asignado.\nRecomendamos actualizar a la versi\u00f3n 8.0 o posterior."
          }
        ],
        "id": "CVE-2025-59728",
        "lastModified": "2026-10-09T10:10:00.193",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "cve-coordination@google.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-59728",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-08T03:55:09.505657Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-06T08:15:34.220",
        "references": [
          {
            "source": "cve-coordination@google.com",
            "url": "https://issuetracker.google.com/433502298"
          }
        ],
        "sourceIdentifier": "cve-coordination@google.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "cve-coordination@google.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-28T08:45:09+00:00",
      "cve": "CVE-2025-59728",
      "id": "CVE-2025-59728",
      "initial_release_date": "2025-10-06T08:08:27.410000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "FFmpeg: FFmpeg: Out-of-bounds NUL-byte write in MPEG-DASH manifest handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59728.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-30T01:45:22Z",
      "cve": "CVE-2025-59728",
      "id": "CVE-2025-59728",
      "initial_release_date": "2025-10-06T23:23:03Z",
      "product_status:known_not_affected": "659",
      "product_status:recommended": "188",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-59728",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-59728.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-59728",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-08T03:55:09.505657Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-06T16:30:35.794Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://git.ffmpeg.org/ffmpeg.git",
              "defaultStatus": "unaffected",
              "product": "MPEG-DASH",
              "repo": "https://git.ffmpeg.org/ffmpeg.git",
              "vendor": "FFmpeg",
              "versions": [
                {
                  "lessThan": "8.0",
                  "status": "affected",
                  "version": "7.1.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.0",
                  "status": "affected",
                  "version": "a218cafe4d3be005ab0c61130f90db4d21afb5db",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Google Big Sleep"
            }
          ],
          "datePublic": "2025-07-21T22:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eWhen calculating the content path in handling of MPEG-DASH manifests, there\u0027s an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call \u003ccode\u003exmlNodeGetContent\u003c/code\u003e\u0026nbsp;below [0], it returns a buffer precisely allocated to match the string length, using \u003ccode\u003estrdup\u003c/code\u003e\u0026nbsp;internally. If this buffer is not an empty string, it is assigned to \u003ccode\u003eroot_url\u003c/code\u003e\u0026nbsp;at [1].If the last (non-NUL) byte in this buffer is not \u003ccode\u003e\u0027/\u0027\u003c/code\u003e\u0026nbsp;then we append \u003ccode\u003e\u0027/\u0027\u003c/code\u003e\u0026nbsp;in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\u003cbr\u003eWe recommend upgrading to version 8.0 or beyond.\u003c/p\u003e\u003cbr\u003e"
                }
              ],
              "value": "When calculating the content path in handling of MPEG-DASH manifests, there\u0027s an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent\u00a0below [0], it returns a buffer precisely allocated to match the string length, using strdup\u00a0internally. If this buffer is not an empty string, it is assigned to root_url\u00a0at [1].If the last (non-NUL) byte in this buffer is not \u0027/\u0027\u00a0then we append \u0027/\u0027\u00a0in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.\nWe recommend upgrading to version 8.0 or beyond."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-100",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-100 Overflow Buffers"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "CWE-787 Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-06T08:08:27.410Z",
            "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
            "shortName": "Google"
          },
          "references": [
            {
              "url": "https://issuetracker.google.com/433502298"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "assignerShortName": "Google",
        "cveId": "CVE-2025-59728",
        "datePublished": "2025-10-06T08:08:27.410Z",
        "dateReserved": "2025-09-19T08:11:37.549Z",
        "dateUpdated": "2026-02-26T17:48:18.443Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.