CVE-2025-59731 | THREATINT

Description

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size. We recommend upgrading to version 8.0 or beyond.

PUBLISHED Reserved 2025-09-19 | Published 2025-10-06 | Updated 2025-10-19 | Assigner Google

MEDIUM: 6.9CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Problem types

CWE-787 Out-of-bounds Write

Product status

Default status

unaffected

9a32b863074ed4140141e0d3613905c6f1fe61c5 (custom) before 8.0

affected

7.1.1 (semver) before 8.0

affected

Credits

Google Big Sleep finder

References

issuetracker.google.com/436510153

cve.org (CVE-2025-59731)

nvd.nist.gov (CVE-2025-59731)

Download JSON