CVE-2025-59731
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-787
Escritura fuera de límites
Fecha de publicación:
06/10/2025
Última modificación:
19/10/2025
Descripción
*** Pendiente de traducción *** When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.<br />
<br />
We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.<br />
<br />
<br />
<br />
<br />
We recommend upgrading to version 8.0 or beyond.
Impacto
Puntuación base 4.0
6.90
Gravedad 4.0
MEDIA