CVE-2025-59728

Name of the Vulnerable Software and Affected Versions Software versions prior to 8.0

Description An issue exists in the handling of MPEG-DASH manifests where an out-of-bounds NUL-byte write occurs one byte past the end of the buffer. This happens during the calculation of the content path. The xmlNodeGetContent function returns a buffer allocated to match the string length using strdup. If the buffer is not empty, it is assigned to root url. If the last byte in the buffer is not '/', a '/' is appended, potentially writing beyond the buffer's allocated space.

Recommendations Upgrade to version 8.0 or beyond.