CVE-2025-59728: MPEG-DASH Buffer Overflow Vulnerability

CVE-2025-59728 Overview

CVE-2025-59728 is an out-of-bounds write vulnerability [CWE-787] in the MPEG-DASH manifest handling logic of a media processing component tracked through the Google Issue Tracker. The flaw occurs when the code calculates the content path from a Dynamic Adaptive Streaming over HTTP (DASH) manifest. Specifically, the parser calls xmlNodeGetContent, which returns a buffer sized exactly to the string length. When the last byte is not /, the code appends / in place, writing one byte past the allocated buffer. The vendor recommends upgrading to version 8.0 or later.

Critical Impact
A crafted MPEG-DASH manifest can trigger a one-byte heap out-of-bounds NUL write, corrupting adjacent heap metadata and enabling potential code execution or memory disclosure on affected media clients.

Affected Products

Media component that parses MPEG-DASH manifests referenced in Google Issue Tracker 433502298
Versions prior to 8.0 of the affected component
Downstream applications embedding the vulnerable DASH parser

Discovery Timeline

2025-10-06 - CVE-2025-59728 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59728

Vulnerability Analysis

The defect resides in the routine that builds the root_url used to resolve DASH segment paths. The parser invokes xmlNodeGetContent on the base URL element in the manifest. xmlNodeGetContent internally uses strdup, returning a buffer allocated precisely to hold the string plus its terminating NUL. The pointer is then assigned to root_url.

The parser inspects the last non-NUL character. If it is not /, the code appends / in place, followed by a NUL terminator. Because the buffer has no headroom, the appended byte overwrites the existing NUL terminator, and the new NUL terminator is written one byte past the allocation. This produces a single-byte heap overflow, classified under CWE-787 (Out-of-bounds Write).

Single-byte heap overflows are exploitable in modern allocators through techniques such as heap metadata corruption, freelist manipulation, and adjacent object confusion. A remote attacker who controls the base URL element in a DASH manifest can influence this condition without user interaction beyond initiating playback.

Root Cause

The root cause is missing allocation growth before an in-place string modification. The code assumes the buffer returned by xmlNodeGetContent contains spare capacity for an additional character, but strdup returns a tight allocation. No realloc or bounds check precedes the trailing / append operation.

Attack Vector

Exploitation requires the target client to load an attacker-controlled MPEG-DASH manifest. The attacker delivers a manifest whose base URL string does not end in /, causing the vulnerable append path to trigger. The attack surface aligns with adjacent network access, low privileges, and no user interaction beyond media consumption. Successful exploitation yields high confidentiality and integrity impact on the vulnerable component and adjacent subsystem context. See the Google Issue Tracker Entry for technical details.

Detection Methods for CVE-2025-59728

Indicators of Compromise

Crashes or heap corruption traces in media pipeline processes shortly after loading DASH manifests
Outbound requests to unexpected origins delivering .mpd manifest files with unusually crafted BaseURL elements
Client-side allocator errors referencing xmlNodeGetContent or DASH manifest parsing frames in stack traces

Detection Strategies

Inspect DASH .mpd payloads in transit for BaseURL values that omit a trailing / and terminate on unusual byte boundaries
Monitor endpoint telemetry for repeated crashes of media player processes correlated with network fetches of manifest files
Correlate media application faults with fetches to newly registered or low-reputation streaming domains

Monitoring Recommendations

Enable heap hardening and Address Sanitizer builds in test pipelines that consume third-party media manifests
Log full URLs of .mpd manifest fetches at the proxy layer for retrospective analysis
Track versioning of embedded media libraries to identify hosts still running pre-8.0 releases

How to Mitigate CVE-2025-59728

Immediate Actions Required

Upgrade the affected media component to version 8.0 or later, per the vendor advisory
Inventory all applications embedding the vulnerable DASH parser and prioritize patching of internet-facing clients
Restrict media playback to trusted manifest origins where feasible during the patch window

Patch Information

The vendor fix is available in version 8.0 and later. The patch adjusts the buffer handling so that appending / no longer writes past the allocation returned by xmlNodeGetContent. Refer to the Google Issue Tracker Entry for commit-level details and downstream integration guidance.

Workarounds

Block or proxy-filter MPEG-DASH manifests originating from untrusted domains until patched
Disable DASH playback in affected applications where an alternate streaming format such as HLS is available
Enforce content security policies that restrict manifest sources to allow-listed CDNs

bash

# Example proxy rule to block untrusted .mpd manifest fetches
iptables -A OUTPUT -p tcp --dport 443 -m string \
  --string ".mpd" --algo bm -m owner \
  ! --uid-owner trusted-media -j REJECT