CVE-2025-59729
Severity CVSS v4.0:
MEDIUM
Type:
CWE-787
Out-of-bounds Write
Publication date:
06/10/2025
Last modified:
06/10/2025
Description
When parsing the header for a DHAV file, there&#39;s an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer.<br />
<br />
If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have end_buffer_size = 0x100000, and at [2] we have end_buffer_pos = 0x1000.<br />
<br />
The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we&#39;ll calculate end_pos based on a 32-bit offset read from the buffer.<br />
<br />
There is subsequently a check [3] that end_pos is within the section of the file that has been copied into end_buffer, but it only correctly handles the cases where end_pos is before the start of the file or after the section copied into end_buffer, and not the case where end_pos is within the the file, but before the section copied into end_buffer. If we provide such an offset, (end_pos - end_buffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation.<br />
<br />
We recommend upgrading to version 8.0 or beyond.
Impact
Base Score 4.0
5.70
Severity 4.0
MEDIUM