CVE-2025-59734: 
Ffmpeg vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2025-59734) exists in SANM decoding when processing a carefully crafted animation using subversion <2. The vulnerability was discovered on October 6, 2025, and affects FFmpeg software (Ubuntu Security).

The vulnerability occurs when a STOR chunk is present and a subsequent FOBJ chunk is saved in ctx->storedframe. In files using subversion < 2, if a frame has an invalid size in processframeobj, it returns 0, causing decode_frame to store the raw frame buffer into ctx->storedframe while leaving ctx->hasdimensions set to false. When a subsequent FTCH chunk calls processftch, it decodes the frame again, adding top/left values and calling processframeobj, which sets dimensions and calls init_buffers, potentially reallocating and freeing the previous buffer while GetByteContext still holds a reference to the old buffer (Ubuntu Security).

When exploited, the vulnerability can lead to use-after-free read operations when using GetByteContext. While GetByteContext is only used for reading bytes, limiting direct write access, the vulnerability can potentially corrupt allocator's metadata when processftch restores original values for top/left in storedframe, writing 4 bytes to the freed data at offset 6 (Ubuntu Security).

The recommended mitigation is to upgrade to FFmpeg version 8.0 or beyond (Ubuntu Security).