{"action":"Upgrade ffmpeg to 7:7.1.2-0+deb13u1 or later.","affected":[{"fixed":"7:7.1.2-0+deb13u1","introduced":"0"}],"component":"ffmpeg","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["7:7.1.2-0+deb13u1"],"id":"tcs_01M5NP3PC2R88B83R9ETQFD0AC","modified_at":"2026-10-23T17:47:31.654179222Z","published_at":"2025-10-06T08:15:35.080Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-59733","https://security-tracker.debian.org/tracker/CVE-2025-59733"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-59733#Debian:13/ffmpeg","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-59733"}],"summary":"When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type (and size), and that if there are four channels, the f"}