CVE-2025-59734: SANM Decoder Use-After-Free Vulnerability

CVE-2025-59734 Overview

CVE-2025-59734 is a use-after-free write vulnerability [CWE-416] in the SANM video decoder. The flaw affects animation files using subversion <2 when a STOR chunk is followed by an FTCH chunk referencing an invalidly sized frame. Processing such a file causes the decoder to free its stored_frame buffer while a GetByteContext reference still points to the released memory. A subsequent restore operation writes 4 bytes into the freed region, corrupting allocator metadata. The issue triggers during format probing, so an attacker does not need the file to be fully played. Maintainers recommend upgrading to version 8.0 or later.

Critical Impact
Attackers can corrupt heap allocator metadata simply by having a target probe a malicious file for the SANM format, with no user interaction beyond file access.

Affected Products

SANM decoder implementations using subversion <2 parsing logic
Multimedia libraries embedding the affected SANM codec prior to version 8.0
Applications that probe untrusted files for the SANM container format

Discovery Timeline

2025-10-06 - CVE-2025-59734 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59734

Vulnerability Analysis

The vulnerability resides in the SANM decoding pipeline that handles STOR and FTCH chunks. When a STOR chunk precedes an FOBJ chunk, the decoder saves the subsequent frame into ctx->stored_frame for later reference. For files using subversion <2, the raw undecoded frame is stored and decoded again whenever an FTCH chunk reaches back to it.

The defect occurs because process_frame_obj returns 0 early when the frame size is invalid, yet decode_frame still copies the raw buffer into ctx->stored_frame and leaves ctx->has_dimensions set to false. A later FTCH chunk calls process_ftch, which re-enters process_frame_obj. This time dimensions are set, init_buffers runs, and the reallocation frees the previous backing buffer. The stale GetByteContext object gb still references the freed memory, producing a use-after-free read when codecs consume bytes from it. On return, process_ftch restores the original top/left values in stored_frame, writing 4 bytes at offset 6 into freed memory and corrupting allocator metadata.

Root Cause

The root cause is inconsistent state handling between process_frame_obj and decode_frame. The early-return path on invalid frame size does not prevent the raw buffer from being cached, and has_dimensions remains false. This violates the invariant that buffers cached for FTCH reuse must already correspond to validated geometry.

Attack Vector

An attacker crafts a SANM animation containing a STOR chunk, an FOBJ chunk with an invalid frame size, and a subsequent FTCH chunk. Delivering the file to a target that probes or decodes SANM media is sufficient to trigger the use-after-free. Because format probing alone reaches the vulnerable path, embedded media handlers and thumbnailers expand the exposure surface across adjacent-network delivery channels.

The vulnerability mechanism is described in the Google Issue Tracker entry. No public proof-of-concept code has been verified.

Detection Methods for CVE-2025-59734

Indicators of Compromise

SANM/SMUSH animation files containing a STOR chunk followed by an FOBJ chunk with malformed dimensions and a trailing FTCH chunk
Process crashes or heap corruption reports in multimedia framework processes during file probing or thumbnail generation
AddressSanitizer or libheap diagnostics reporting use-after-free in process_ftch or decode_frame call stacks

Detection Strategies

Inspect inbound media files for SANM headers and flag those with subversion <2 originating from untrusted sources
Hunt for unexpected child process crashes in media probing services (ffprobe, thumbnailers, indexers) using endpoint telemetry
Apply runtime memory-safety instrumentation in test pipelines to surface use-after-free conditions before production exposure

Monitoring Recommendations

Forward crash logs and core dumps from media-handling services to a centralized data lake for correlation
Alert on repeated decoder faults from a single user or share, which can indicate fuzzing or active exploitation attempts
Track installed versions of multimedia libraries across endpoints to confirm patch coverage against the 8.0 baseline

How to Mitigate CVE-2025-59734

Immediate Actions Required

Upgrade affected SANM decoder components to version 8.0 or later as recommended by upstream maintainers
Disable or restrict SANM format probing on services that process untrusted user content until patches are deployed
Audit applications that link the vulnerable decoder and prioritize patching of public-facing media processing endpoints

Patch Information

The maintainer guidance is to upgrade to version 8.0 or beyond. Technical fix details are tracked in the Google Issue Tracker entry.

Workarounds

Block SANM/SMUSH file extensions and MIME types at email and web gateways where the format is not required
Sandbox media probing and decoding processes with seccomp, AppArmor, or equivalent isolation to contain heap corruption impact
Remove or unregister the SANM demuxer from build configurations when the format is unused by the application

bash

# Configuration example: disable SANM demuxer at build time
./configure --disable-decoder=sanm --disable-demuxer=smush
make && make install