Out-of-Bounds Write Vulnerability in MPEG-DASH Handling by Google

CVE-2025-59728

What is CVE-2025-59728?

This vulnerability arises from an improper calculation of content paths during the processing of MPEG-DASH manifests, leading to an out-of-bounds NUL-byte write. Specifically, the issue occurs when the function attempts to append a NUL byte to the buffer allocated for the content path, exceeding its defined limits. If the last character in the buffer is not a '/', the application writes the NUL byte past the end of the allocated memory, potentially resulting in unexpected behavior or exploitation. Users are strongly advised to upgrade to version 8.0 or higher to mitigate this risk.

References