CVE-2025-59733: 
Ffmpeg vulnerability analysis and mitigation

CVE-2025-59733 is an out-of-bounds write vulnerability in FFmpeg's OpenEXR decoder that occurs when processing files using DWAA or DWAB compression. The flaw stems from incorrect assumptions in the dwa_uncompress function about channel count, ordering, and pixel type uniformity. Affected versions include FFmpeg prior to 8.0 (including commit 9a32b863074ed4140141e0d3613905c6f1fe61c5 and version 7.1.1). It was published on October 6, 2025, and carries a CVSS v4.0 base score of 8.7 (High) (ENISA EUVD).

The root cause is an out-of-bounds write (CWE-787) in FFmpeg's dwa_uncompress function when decoding OpenEXR files with DWAA or DWAB compression. The function implicitly assumes that if four channels are present, they are "B", "G", "R", and "A" in that order, and that all channels share the same pixel type and size. The buffer td->uncompressed_data is allocated in decode_block based on xsize, ysize, and current_channel_offset. An attacker can craft a malicious OpenEXR file where the main color channels use a 4-byte pixel type while additional duplicate or unknown channels use the 2-byte EXR_HALF type; the pointer arithmetic at step [7] then increments by 4 bytes × xsize × nb_channels, exceeding the allocated buffer boundary (ENISA EUVD).

Successful exploitation can result in high confidentiality and integrity impacts on both the vulnerable component and any dependent system components, as reflected in the CVSS v4.0 score. An attacker who tricks a user or automated pipeline into processing a crafted OpenEXR file could achieve out-of-bounds memory writes, potentially leading to arbitrary code execution or sensitive data disclosure. Availability impact is rated as none, suggesting the primary risk is data compromise and code execution rather than denial of service (ENISA EUVD).

1. Craft malicious OpenEXR file: Create an OpenEXR file that uses DWAA or DWAB compression. Configure the main color channels ("B", "G", "R") with a 4-byte pixel type (e.g., EXR_FLOAT), then add a fourth or additional channel using the 2-byte EXR_HALF type — either as a duplicate or unknown channel name.
2. Trigger buffer allocation: When FFmpeg's decode_block processes the file, it allocates td->uncompressed_data based on xsize, ysize, and current_channel_offset, which does not account for the mixed pixel type sizes.
3. Trigger out-of-bounds write: When dwa_uncompress processes the channels, the pointer arithmetic at step [7] increments by 4 bytes × xsize × nb_channels regardless of actual channel sizes, causing a write beyond the allocated buffer boundary.
4. Deliver the file: Distribute the crafted .exr file via email attachment, web download, or shared media storage to a target whose system processes OpenEXR files through FFmpeg (e.g., video editing software, media servers, automated transcoding pipelines).
5. Achieve code execution: Depending on memory layout and heap state, the out-of-bounds write may overwrite adjacent heap metadata or function pointers, potentially enabling arbitrary code execution in the context of the FFmpeg process (ENISA EUVD).

• File System: Unexpected or suspicious .exr files in media processing directories, especially those with unusual channel configurations or abnormally small file sizes relative to declared image dimensions.
• Process: FFmpeg or media processing processes crashing with segmentation faults or heap corruption errors when processing .exr files; core dump files generated in application directories.
• Logs: Application logs showing FFmpeg errors related to OpenEXR DWAA/DWAB decompression failures; crash reports referencing dwa_uncompress or decode_block functions.
• Network: Unexpected outbound connections from media processing servers following processing of externally sourced .exr files, which may indicate post-exploitation activity.

The vendor recommends upgrading FFmpeg to version 8.0 or later, which contains the fix for this vulnerability. Ubuntu has issued security notice USN-7982-1 addressing this and related FFmpeg vulnerabilities (Ubuntu Advisory). Mageia has also released an advisory (MGASA-2025-0306). As a workaround where upgrading is not immediately possible, restrict processing of untrusted or externally sourced OpenEXR files, and consider disabling DWAA/DWAB compression support in FFmpeg build configurations if feasible (ENISA EUVD).

The vulnerability was assigned by Google and tracked under ENISA EUVD-2025-32514. Detection signatures have been added by Qualys (detection IDs 6271262, 6031847) and Nessus (plugin 297270), indicating uptake by major vulnerability management platforms. No notable public researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries (ENISA EUVD, Tenable).