Skip to content
Heist/ feed
Back to feed
High

Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path

Type: advisorySources: OSV

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below [0], it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is not an empty string, it is assigned to root_url at [1].If the last (non-NUL) byte in this buffer is not '/' then we append '/' in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer. We recommend upgrading to version 8.0 or beyond.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-59728
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 01:11 UTC · Revision 1

Source evidence

Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path

core-osv · Original source

Published 6 Oct 2025, 08:08 UTC

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below [0], it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is not an empty string, it is assigned to root_url at [1].If the last (non-NUL) byte in this buffer is not '/' then we append '/' in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer. We recommend upgrading to version 8.0 or beyond.

osv:CVE-2025-59728
Complete source record
{
  "id": "f998028ffafa60657d445c3ba37572192c04b316fe5c2b8d29abd7cba5574a89",
  "url": "https://osv.dev/vulnerability/CVE-2025-59728",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path",
    "summary": "When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below [0], it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is not an empty string, it is assigned to root_url at [1].If the last (non-NUL) byte in this buffer is not '/' then we append '/' in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer. We recommend upgrading to version 8.0 or beyond.",
    "evidence": "osv:CVE-2025-59728",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-59728",
      "aliases": [
        "CVE-2025-59728"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.ffmpeg.org/ffmpeg.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "db69d06eeeab4f46da15030a80d539efb4503ca8"
                },
                {
                  "fixed": "140fd653aed8cad774f991ba083e2d01e86420c7"
                },
                {
                  "introduced": "0"
                },
                {
                  "fixed": "140fd653aed8cad774f991ba083e2d01e86420c7"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "7.1.1"
                      },
                      {
                        "fixed": "8.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "a218cafe4d3be005ab0c61130f90db4d21afb5db"
                      },
                      {
                        "fixed": "8.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "n7.2-dev",
            "n7.1-dev",
            "n6.2-dev",
            "n6.1-dev",
            "n5.2-dev",
            "n5.1-dev",
            "n4.5-dev",
            "n4.4-dev",
            "n4.3-dev",
            "n4.2-dev",
            "n4.1-dev",
            "n3.5-dev",
            "n3.4-dev",
            "n3.3-dev",
            "n3.2-dev",
            "n3.1-dev",
            "n2.9-dev",
            "n2.8-dev",
            "n2.7-dev",
            "n2.6-dev",
            "n2.5-dev",
            "n2.4-dev",
            "n2.3-dev",
            "n2.2-dev",
            "n2.0",
            "n2.1-dev",
            "n1.3-dev",
            "n1.2-dev",
            "n1.1-dev",
            "n0.12-dev",
            "n0.11-dev",
            "n0.8",
            "N"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59728.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:52.366778039Z",
      "provider": "osv",
      "references": [
        "https://issuetracker.google.com/433502298",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59728.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-59728",
        "https://git.ffmpeg.org/ffmpeg.git"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-787"
        ],
        "cna_assigner": "Google",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59728.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-59728",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 521227,
  "published_at": "2025-10-06T08:08:27.41+00:00"
}