{"id":"JLSEC-2026-647","summary":"It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation...","details":"It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion \u003c2.\n\nWhen a STOR chunk is present, a subsequent FOBJ chunk will be saved in ctx-\u003e`stored_frame`. Stored frames can later be referenced by FTCH chunks. For files using subversion \u003c 2, the undecoded frame is stored, and decoded again when the FTCH chunks are parsed. However, in `process_frame_obj` if the frame has an invalid size, there’s an early return, with a value of 0.\n\nThis causes the code in `decode_frame` to still store the raw frame buffer into ctx-\u003e`stored_frame`. Leaving ctx-\u003e`has_dimensions` set to false.\n\nA subsequent chunk with type FTCH would call `process_ftch` and decode that frame obj again, adding to the top/left values and calling `process_frame_obj` again.\nGiven that we never set ctx-\u003e`have_dimensions` before, this time we set the dimensions, calling `init_buffers`, which can reallocate the buffer in ctx-\u003e`stored_frame`, freeing the previous one. However, the GetByteContext object gb still holds a reference to the old buffer.\n\nFinally, when the code tries to decode the frame, codecs that accept a GetByteContext as a parameter will trigger a use-after-free read when using gb.\n\nGetByteContext is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the free and when the object is accessed. However, upon returning to `process_ftch`, the code restores the original values for top/left in `stored_frame`, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator’s metadata.\n\nThis issue can be triggered just by probing whether a file has the sanm format.\n\nWe recommend upgrading to version 8.0 or beyond.","modified":"2026-07-25T18:24:43.844609923Z","published":"2026-06-26T20:24:16.337Z","upstream":["CVE-2025-59734","GHSA-g9mr-r3g9-6594","EUVD-2025-32184"],"database_specific":{"license":"CC-BY-4.0","sources":[{"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-59734","html_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59734","database_specific":{"status":"Deferred"},"id":"CVE-2025-59734","imported":"2026-07-17T22:19:15.998Z","modified":"2026-06-17T09:46:36.900Z","published":"2025-10-06T08:15:35.227Z"},{"modified":"2025-10-19T15:31:16Z","published":"2025-10-06T09:30:20Z","url":"https://api.github.com/advisories/GHSA-g9mr-r3g9-6594","html_url":"https://github.com/advisories/GHSA-g9mr-r3g9-6594","id":"GHSA-g9mr-r3g9-6594","imported":"2026-07-17T22:19:16.194Z"},{"published":"2025-10-06T08:09:44Z","url":"https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2025-32184","html_url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-32184","id":"EUVD-2025-32184","imported":"2026-07-17T22:19:26.099Z","modified":"2026-02-26T17:48:16Z"}]},"references":[{"type":"WEB","url":"https://b.corp.google.com/issues/440183164"},{"type":"WEB","url":"https://github.com/advisories/GHSA-g9mr-r3g9-6594"},{"type":"WEB","url":"https://issuetracker.google.com/440183164"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59734"}],"affected":[{"package":{"name":"FFMPEG_jll","ecosystem":"Julia","purl":"pkg:julia/FFMPEG_jll?uuid=b22a6f82-2f65-5046-a5b2-351ab43fb4e5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.1.1+0"},{"fixed":"8.0.0+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-647.json"}},{"package":{"name":"FFplay_jll","ecosystem":"Julia","purl":"pkg:julia/FFplay_jll?uuid=c4dce911-e170-5107-8314-c7bdc6785395"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0+0"},{"fixed":"8.1.2+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-647.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}