CVE-2025-59729
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-06

Last updated on: 2025-10-06

Assigner: Google Inc.

Description
When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have end_buffer_size = 0x100000, and at [2] we have end_buffer_pos = 0x1000. The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we'll calculate end_pos based on a 32-bit offset read from the buffer. There is subsequently a check [3] that end_pos is within the section of the file that has been copied into end_buffer, but it only correctly handles the cases where end_pos is before the start of the file or after the section copied into end_buffer, and not the case where end_pos is within the the file, but before the section copied into end_buffer. If we provide such an offset, (end_pos - end_buffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation. We recommend upgrading to version 8.0 or beyond.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-06
Last Modified
2025-10-06
Generated
2026-05-06
AI Q&A
2025-10-06
EPSS Evaluated
2026-05-05
NVD
CVE-2025-59729
EUVD
EUVD-2025-32182
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
vendor product 8.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability occurs when parsing the header of a DHAV file. An integer underflow in offset calculation causes the program to read the duration value from before the start of the allocated buffer. Specifically, if a DHAV file larger than the maximum buffer size is loaded, the code scans backwards looking for a tag and calculates an end position based on a 32-bit offset. The check to ensure this end position is within the copied buffer section fails to handle cases where the end position is within the file but before the copied buffer section, leading to an underflow and out-of-bounds read before the buffer allocation.


How can this vulnerability impact me? :

This vulnerability can lead to reading memory before the allocated buffer, which may cause crashes, data corruption, or potentially expose sensitive information from adjacent memory. It could be exploited to cause denial of service or information disclosure depending on how the DHAV file is processed.


What immediate steps should I take to mitigate this vulnerability?

The recommended immediate step to mitigate this vulnerability is to upgrade to version 8.0 or beyond.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart