When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.
We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.
We recommend upgrading to version 8.0 or beyond.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Dec 5, 2025 | Oct 6, 2025 |
| Debian | — | Upgrade ffmpeg | Oct 21, 2025 | Oct 21, 2025 |
| Ffmpeg | — | Upgrade to FFmpeg version 5.1.7Upgrade to FFmpeg version 8.0Upgrade to FFmpeg version 6.1.3Upgrade to FFmpeg version 7.1.2 | Jul 20, 2026 | Oct 6, 2025 |
| Ubuntu | — | Upgrade libavcodec60 (Ubuntu Pro)Upgrade libavformat60 (Ubuntu Pro)Upgrade libavcodec61Upgrade libavcodec-ffmpeg56 (Ubuntu Pro)Upgrade libavformat61Upgrade libavcodec-extra (Ubuntu Pro)Upgrade ffmpegUpgrade libavcodec57 (Ubuntu Pro)Upgrade libavformat-ffmpeg56 (Ubuntu Pro)Upgrade libavcodec58 (Ubuntu Pro)Upgrade libavformat57 (Ubuntu Pro)Upgrade ffmpeg (Ubuntu Pro)Upgrade libavformat58 (Ubuntu Pro) | Jan 29, 2026 | Oct 6, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub