Product:
DHAV file parser
Summary
When parsing the header for a DHAV file, an integer underflow occurs in offset calculation, leading to reading the duration from before the start of the allocated buffer. If a DHAV file larger than MAX_DURATION_BUFFER_SIZE bytes is loaded, the loop scans backwards through the buffer for the dhav tag. A subsequent check fails to handle cases where the calculated end_pos is within the file but before the copied section, resulting in access before the beginning of the allocation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.7 | CVE-2025-59729 |
Exploitation
To exploit this vulnerability, an attacker can create a specially crafted DHAV file that exceeds the MAX_DURATION_BUFFER_SIZE. By manipulating the file’s structure, the attacker can trigger the integer underflow during the parsing process, allowing them to read memory locations before the allocated buffer. This can lead to potential information disclosure or further exploitation of the system.
Affected Products
- DHAV file parser: Vulnerable to integer underflow when processing large DHAV files.
Mitigation
It is recommended to upgrade to version 8.0 or beyond to mitigate this vulnerability. This update addresses the integer underflow issue and ensures proper handling of file parsing, preventing potential exploitation.