Detections
Analytics

Chainguard: multiple ffmpeg-fips-7.1 packages: security update to 7.1.2-r0

high Tenable Cloud Security Plugin ID 476790

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all
 image channels have the same pixel type (and size), and that if there are four channels, the first four
 are "B", "G", "R" and "A". The channel parsing code can be found in decode_header. The buffer
 td->uncompressed_data is allocated in decode_block based on the xsize, ysize and computed
 current_channel_offset. The function dwa_uncompress then assumes at [5] that if there are 4 channels,
 these are "B", "G", "R" and "A", and in the calculations at [6] and [7] that all channels are of the same
 type, which matches the type of the main color channels. If we set the main color channels to a 4-byte
 type and add duplicate or unknown channels of the 2-byte EXR_HALF type, then the addition at [7] will
 increment the pointer by 4-bytes * xsize * nb_channels, which will exceed the allocated buffer. We
 recommend upgrading to version 8.0 or beyond. (CVE-2025-59733)

Solution

Update the ffmpeg-fips-7.1 library and its related packages to version 7.1.2-r0 or later.

Plugin Details

Severity: High

ID: 476790

Version: Revision 1.1

Type: Local

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.94

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2025-59733

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 5.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2025

Reference Information

CVE: CVE-2025-59733