Search
Find a vulnerability
Search criteria
180 vulnerabilities found for ffmpeg by ffmpeg
CVE-2026-125270 (GCVE-0-2026-125270)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 19:12
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder
Summary
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output.
Severity
5.3 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24328 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/b8f159858… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-08-31 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Wenjie Yin"
}
],
"datePublic": "2026-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:10.299Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24328"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/b8f159858e2fd29dae4fa34d9e713bbf9bbf190e"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.c#L410"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-out-of-bounds-read-in-v4l2-m2m-encoder"
}
],
"title": "FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125270",
"datePublished": "2026-11-09T19:12:10.299Z",
"dateReserved": "2026-11-09T18:15:36.772Z",
"dateUpdated": "2026-11-09T19:12:10.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125269 (GCVE-0-2026-125269)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 19:12
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c
Summary
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.
Severity
CWE
- CWE-415 - Double Free
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25020 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/2c515eea0… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-12 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claude and Ada Logics"
},
{
"lang": "en",
"type": "reporter",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:09.590Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25020"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/2c515eea07df719379e7f73deeeb7ccb8768433f"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cbs_sei.c#L287"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-double-free-via-cbs-sei-delete-message-in-cbs-sei-c"
}
],
"title": "FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125269",
"datePublished": "2026-11-09T19:12:09.590Z",
"dateReserved": "2026-11-09T18:15:36.455Z",
"dateUpdated": "2026-11-09T19:12:09.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125268 (GCVE-0-2026-125268)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-10 16:09
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
Summary
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:08 UTC
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/0bfa35029… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125268",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:08:57.034949Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:09:10.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:08.871Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/0bfa350291b2118f6d590263dc1ee9cea766c0f1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cfhd.c#L292"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-in-cfhd-decoder"
}
],
"title": "FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125268",
"datePublished": "2026-11-09T19:12:08.871Z",
"dateReserved": "2026-11-09T18:15:36.146Z",
"dateUpdated": "2026-11-10T16:09:10.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125267 (GCVE-0-2026-125267)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-10 19:08
VLAI
EPSS
VEX
Title
FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder
Summary
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 19:02 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24432 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/e15ddb7f9… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T19:02:12.439307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:08:08.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThan": "8.1.3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "9.0.2",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.1.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.0.2",
"versionStartIncluding": "9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Umar Pathan (Umar0x)"
},
{
"lang": "en",
"type": "reporter",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Umar Pathan"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:08.200Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24432"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/e15ddb7f9a2f9b3ab8ac305efb6f94ddc18463d0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/apac.c#L146"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-heap-out-of-bounds-write-via-apac-decoder"
}
],
"title": "FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125267",
"datePublished": "2026-11-09T19:12:08.200Z",
"dateReserved": "2026-11-09T18:15:35.826Z",
"dateUpdated": "2026-11-10T19:08:08.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125266 (GCVE-0-2026-125266)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 19:12
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23
Summary
FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.
Severity
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/d42cb1925… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"versionStartIncluding": "8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:07.485Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/d42cb1925987cc27899441ce39fa7bd2647dc72e"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sanm.c#L799"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-stack-memory-disclosure-via-sanm-codec-23"
}
],
"title": "FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125266",
"datePublished": "2026-11-09T19:12:07.485Z",
"dateReserved": "2026-11-09T18:15:35.487Z",
"dateUpdated": "2026-11-09T19:12:07.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125265 (GCVE-0-2026-125265)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 19:12
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer
Summary
FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.
Severity
5.3 (Medium)
CWE
- CWE-416 - Use After Free
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/03cd78519… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx-\u003ebitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:06.735Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/03cd7851955c023f1ff4c8a495d47e996d01485a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/nvdec.c#L694"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-use-after-free-via-nvdec-stale-bitstream-pointer"
}
],
"title": "FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125265",
"datePublished": "2026-11-09T19:12:06.735Z",
"dateReserved": "2026-11-09T18:15:35.137Z",
"dateUpdated": "2026-11-09T19:12:06.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125264 (GCVE-0-2026-125264)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 20:56
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count
Summary
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in libavcodec/jpegxl_parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toc_count, making the parser loop excessively and exhaust CPU.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:54 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/bc896c613… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:54:30.873322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:56:48.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in libavcodec/jpegxl_parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toc_count, making the parser loop excessively and exhaust CPU."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "Unchecked Input for Loop Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:06.047Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/bc896c613ec0d4ad0108d62fbdda0196f69e7121"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/jpegxl_parser.c#L1343"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-cpu-exhaustion-via-jpeg-xl-parser-toc-count"
}
],
"title": "FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125264",
"datePublished": "2026-11-09T19:12:06.047Z",
"dateReserved": "2026-11-09T18:15:34.736Z",
"dateUpdated": "2026-11-09T20:56:48.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125263 (GCVE-0-2026-125263)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 20:56
VLAI
EPSS
VEX
Title
FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions
Summary
FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized get_buffer2() allocations and exhaust memory.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:54 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/60b286521… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-9.0-t… | third-party-advisory |
Impacted products
Date Public
2026-10-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:54:46.620010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:56:48.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"versionStartIncluding": "9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized get_buffer2() allocations and exhaust memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:05.359Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/60b286521b46caa09792af04c6a4e3437aac8293"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/decode.c#L1660"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-memory-exhaustion-via-lcevc-enhancement-dimensions"
}
],
"title": "FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125263",
"datePublished": "2026-11-09T19:12:05.359Z",
"dateReserved": "2026-11-09T18:15:34.392Z",
"dateUpdated": "2026-11-09T20:56:48.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125262 (GCVE-0-2026-125262)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 19:12
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding
Summary
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "7.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ayoub Nabil Boubagrat"
},
{
"lang": "en",
"type": "reporter",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:04.655Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613a48665dcb8d14186b33dad90aa40ae0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/lcevcdec.c#L224"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding"
}
],
"title": "FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125262",
"datePublished": "2026-11-09T19:12:04.655Z",
"dateReserved": "2026-11-09T18:15:34.069Z",
"dateUpdated": "2026-11-09T19:12:04.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125261 (GCVE-0-2026-125261)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 19:12
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c
Summary
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process.
Severity
6.1 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/c6e5b6105… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-02 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder\u0027s encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:03.938Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/c6e5b6105aa13f6b0df2a646da608078cfe52d79"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sgienc.c#L208"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-sgi-encoder-out-of-bounds-read-via-sgienc-c"
}
],
"title": "FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125261",
"datePublished": "2026-11-09T19:12:03.938Z",
"dateReserved": "2026-11-09T18:15:33.734Z",
"dateUpdated": "2026-11-09T19:12:03.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125260 (GCVE-0-2026-125260)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-10 16:08
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path
Summary
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encode_scanline_rle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows mid-stream, transcoded to OpenEXR with RLE compression, to write pointers past the scanline array and crash the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:08 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/9b99973b2… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:08:28.499003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:08:42.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encode_scanline_rle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows mid-stream, transcoded to OpenEXR with RLE compression, to write pointers past the scanline array and crash the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:03.272Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b7e1e57035b95498b42f54a6"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/exrenc.c#L226"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-in-exr-encoder-rle-path"
}
],
"title": "FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125260",
"datePublished": "2026-11-09T19:12:03.272Z",
"dateReserved": "2026-11-09T18:15:33.414Z",
"dateUpdated": "2026-11-10T16:08:42.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125259 (GCVE-0-2026-125259)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-10 19:08
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ks Encoder
Summary
FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder, causing encode_frame() to write slices past an undersized packet buffer and corrupt heap memory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 19:02 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25573 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/439b452f9… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T19:02:08.760843Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:08:16.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder, causing encode_frame() to write slices past an undersized packet buffer and corrupt heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:02.579Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25573"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/439b452f9fe916a9f7d8788ab6afee8fac846b0b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/proresenc_kostya_common.c#L286"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ks Encoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-prores-prores-ks-encoder"
}
],
"title": "FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ks Encoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125259",
"datePublished": "2026-11-09T19:12:02.579Z",
"dateReserved": "2026-11-09T18:15:33.097Z",
"dateUpdated": "2026-11-10T19:08:16.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125258 (GCVE-0-2026-125258)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 20:56
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c
Summary
FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:55 UTC
CWE
- CWE-369 - Divide By Zero
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/ab28d57ba… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125258",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:55:03.666768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:56:48.553Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-369",
"description": "Divide By Zero",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:01.864Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/ab28d57ba2ec07b41b4a60ed8806b13a39ec86fe"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dovi_rpuenc.c#L187"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-division-by-zero-via-dovi-configure-ext-in-dovi-rpuenc-c"
}
],
"title": "FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125258",
"datePublished": "2026-11-09T19:12:01.864Z",
"dateReserved": "2026-11-09T18:15:32.769Z",
"dateUpdated": "2026-11-09T20:56:48.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125257 (GCVE-0-2026-125257)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-09 19:12
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search
Summary
FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPT_SIZE and overwrite adjacent heap memory.
Severity
CWE
- CWE-193 - Off-by-one Error
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24471 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/733bec3e1… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-09-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zheng Yu"
},
{
"lang": "en",
"type": "reporter",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPT_SIZE and overwrite adjacent heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-193",
"description": "Off-by-one Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:01.153Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24471"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/733bec3e19759520ccdbeb6c3c0cae280bbe6dc5"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/nellymoserenc.c#L262"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-via-nellymoser-encoder-trellis-search"
}
],
"title": "FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125257",
"datePublished": "2026-11-09T19:12:01.153Z",
"dateReserved": "2026-11-09T18:15:32.455Z",
"dateUpdated": "2026-11-09T19:12:01.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125256 (GCVE-0-2026-125256)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:12 – Updated: 2026-11-10 16:08
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine
Summary
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:07 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25573 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/1f7bdea65… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:07:58.287401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:08:09.111Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "7.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder\u0027s temp buffer."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:12:00.407Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25573"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/1f7bdea654a8a9a1761759e22d83943371cff21f"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/riscv/llvidencdsp_rvv.S#L26"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-risc-v-vector-diff-bytes-routine"
}
],
"title": "FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125256",
"datePublished": "2026-11-09T19:12:00.407Z",
"dateReserved": "2026-11-09T18:15:32.104Z",
"dateUpdated": "2026-11-10T16:08:09.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125255 (GCVE-0-2026-125255)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-10 19:08
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding
Summary
FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 18:18 UTC
CWE
- CWE-416 - Use After Free
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/f58a67765… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T18:18:21.225207Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:08:26.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:59.708Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/f58a6776546567367baf5223df9ffbfd289299f8"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mjpegdec.c#L831"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-use-after-free-in-mjpeg-hardware-accelerated-decoding"
}
],
"title": "FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125255",
"datePublished": "2026-11-09T19:11:59.708Z",
"dateReserved": "2026-11-09T18:15:31.740Z",
"dateUpdated": "2026-11-10T19:08:26.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125254 (GCVE-0-2026-125254)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 20:56
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()
Summary
FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ff_vvc_mv_scale(), crashing the decoding process.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:55 UTC
CWE
- CWE-369 - Divide By Zero
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/8732d7585… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:55:19.505683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:56:48.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ff_vvc_mv_scale(), crashing the decoding process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-369",
"description": "Divide By Zero",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:59.000Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/8732d7585cd8ab9d1dd9baeb4db5e93466c0efa7"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vvc/mvs.c#L77"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-division-by-zero-via-vvc-ff-vvc-slice-rpl"
}
],
"title": "FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125254",
"datePublished": "2026-11-09T19:11:59.000Z",
"dateReserved": "2026-11-09T18:15:31.394Z",
"dateUpdated": "2026-11-09T20:56:48.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125253 (GCVE-0-2026-125253)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 19:11
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read
Summary
FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.
Severity
5.3 (Medium)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/6280907da… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:58.269Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/6280907da48c4dd78f95ef5c713a29c7702153a3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cbs_vp9.c#L400"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vp9-cbs-superframe-integer-overflow-out-of-bounds-read"
}
],
"title": "FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125253",
"datePublished": "2026-11-09T19:11:58.269Z",
"dateReserved": "2026-11-09T18:15:31.011Z",
"dateUpdated": "2026-11-09T19:11:58.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125252 (GCVE-0-2026-125252)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 20:56
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers
Summary
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:55 UTC
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/4221a63ce… | patch |
| https://github.com/FFmpeg/FFmpeg/commit/838c660bb… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125252",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:55:35.526949Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:56:48.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:57.570Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/4221a63ce869ade862557ca64693bf77f5032971"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/838c660bb3cd66ba74981b453c14c79214f6ef92"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vaapi_decode.c#L117"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vaapi-memory-leak-via-abandoned-picture-buffers"
}
],
"title": "FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125252",
"datePublished": "2026-11-09T19:11:57.570Z",
"dateReserved": "2026-11-09T18:15:30.689Z",
"dateUpdated": "2026-11-09T20:56:48.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125251 (GCVE-0-2026-125251)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-10 19:08
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c
Summary
FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 19:02 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/053660fdb… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125251",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T19:02:06.070883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:08:35.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:56.865Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/053660fdb0d2403b838690689c47ad7685c3b10b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vvc/refs.c#L148"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vvc-decoder-heap-out-of-bounds-write-via-refs-c"
}
],
"title": "FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125251",
"datePublished": "2026-11-09T19:11:56.865Z",
"dateReserved": "2026-11-09T18:15:30.370Z",
"dateUpdated": "2026-11-10T19:08:35.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125250 (GCVE-0-2026-125250)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 19:11
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap
Summary
FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding.
Severity
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/26c298098… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-02 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder\u0027s gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame\u0027s linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:56.203Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/26c2980980295e5516f308c5a2792d2a72e43eae"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/gif.c#L405"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-gif-encoder-heap-buffer-overflow-via-shrunk-buf-remap"
}
],
"title": "FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125250",
"datePublished": "2026-11-09T19:11:56.203Z",
"dateReserved": "2026-11-09T18:15:30.040Z",
"dateUpdated": "2026-11-09T19:11:56.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125249 (GCVE-0-2026-125249)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 19:11
VLAI
EPSS
VEX
Title
FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing
Summary
FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.
Severity
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-7.1-t… | third-party-advisory |
Impacted products
Date Public
2026-10-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "7.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:55.546Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vulkan_decode.c#L345"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-7.1-through-9.0.2-heap-out-of-bounds-write-via-vulkan-slice-buffer-sizing"
}
],
"title": "FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125249",
"datePublished": "2026-11-09T19:11:55.546Z",
"dateReserved": "2026-11-09T18:15:29.700Z",
"dateUpdated": "2026-11-09T19:11:55.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125248 (GCVE-0-2026-125248)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-10 16:07
VLAI
EPSS
VEX
Title
FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer
Summary
FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:07 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-9.0-t… | third-party-advisory |
Impacted products
Date Public
2026-10-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:07:18.628440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:07:29.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"versionStartIncluding": "9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:54.890Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/ffv1enc_vulkan.c#L330"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-integer-overflow-via-ffv1-vulkan-encoder-remap-buffer"
}
],
"title": "FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125248",
"datePublished": "2026-11-09T19:11:54.890Z",
"dateReserved": "2026-11-09T18:15:29.371Z",
"dateUpdated": "2026-11-10T16:07:29.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125247 (GCVE-0-2026-125247)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-10 19:08
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Integer Overflow via dng_decode_tiles() in libavcodec/tiff.c
Summary
FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 18:18 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24999 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/a9c070e52… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T18:18:18.923864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:08:47.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "OSS-Fuzz"
},
{
"lang": "en",
"type": "reporter",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:54.222Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24999"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/a9c070e52fecb7fb247db829130899db07953823"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tiff.c#L1007"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Integer Overflow via dng_decode_tiles() in libavcodec/tiff.c",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-integer-overflow-via-dng-decode-tiles-in-libavcodec-tiff-c"
}
],
"title": "FFmpeg through 9.0.2 Integer Overflow via dng_decode_tiles() in libavcodec/tiff.c",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125247",
"datePublished": "2026-11-09T19:11:54.222Z",
"dateReserved": "2026-11-09T18:15:28.992Z",
"dateUpdated": "2026-11-10T19:08:47.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125246 (GCVE-0-2026-125246)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 20:56
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment
Summary
FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 abort when CBS-based bitstream filters process it.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:55 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/ee457fdcd… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:55:51.077855Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:56:48.973Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 abort when CBS-based bitstream filters process it."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:53.517Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/ee457fdcdb3a069ef35910a2e1cacff10906b131"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cbs_jpeg.c#L365"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-assertion-failure-dos-via-cbs-jpeg-assemble-fragment"
}
],
"title": "FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125246",
"datePublished": "2026-11-09T19:11:53.517Z",
"dateReserved": "2026-11-09T18:15:28.593Z",
"dateUpdated": "2026-11-09T20:56:48.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125245 (GCVE-0-2026-125245)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 20:56
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding
Summary
FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:56 UTC
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/50e9ef29b… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125245",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:56:07.780785Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:56:49.121Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lynne"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:52.843Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/50e9ef29be1766404115b0a4908fa3fd6ed7fa3f"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mjpegdec.c#L826"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-mjpeg-hwaccel-sof-decoding"
}
],
"title": "FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125245",
"datePublished": "2026-11-09T19:11:52.843Z",
"dateReserved": "2026-11-09T18:15:28.288Z",
"dateUpdated": "2026-11-09T20:56:49.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125244 (GCVE-0-2026-125244)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-10 16:06
VLAI
EPSS
VEX
Title
FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points
Summary
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's sh_entry_points() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing entry_point_start_ctu and corrupting decoder memory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:06 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24537 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/a809a784e… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125244",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:06:35.501645Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:06:48.326Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThan": "8.1.3",
"status": "affected",
"version": "7.0",
"versionType": "custom"
},
{
"lessThan": "9.0.2",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.1.3",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.0.2",
"versionStartIncluding": "9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Umar Pathan (Umar0x)"
},
{
"lang": "en",
"type": "reporter",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Umar Pathan"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder\u0027s sh_entry_points() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing entry_point_start_ctu and corrupting decoder memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:52.137Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24537"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/a809a784ec9ff9910161c6c9554a041941d6ccce"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/vvc/ps.c#L1453"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-vvc-decoder-out-of-bounds-write-via-sh-entry-points"
}
],
"title": "FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125244",
"datePublished": "2026-11-09T19:11:52.137Z",
"dateReserved": "2026-11-09T18:15:27.966Z",
"dateUpdated": "2026-11-10T16:06:48.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125243 (GCVE-0-2026-125243)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-10 19:08
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder
Summary
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 18:18 UTC
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25303 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/60bc31fcf… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125243",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T18:18:16.617492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:08:54.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Martin Mirchev"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:51.439Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25303"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/60bc31fcf6543505e6d2fc1a9399cca95f54ba4d"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/jpeglsdec.c#L483"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-jpeg-ls-decoder"
}
],
"title": "FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125243",
"datePublished": "2026-11-09T19:11:51.439Z",
"dateReserved": "2026-11-09T18:15:27.624Z",
"dateUpdated": "2026-11-10T19:08:54.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125242 (GCVE-0-2026-125242)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 20:56
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table
Summary
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before end_frame. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstream_buffers table continuously and causing denial of service.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:56 UTC
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/2c6cd8098… | patch |
| https://github.com/FFmpeg/FFmpeg/commit/eac2bedcf… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:56:23.321151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:56:49.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before end_frame. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstream_buffers table continuously and causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:50.739Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/2c6cd8098844f2367f8ba0a3a483e405c8f76449"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/eac2bedcf6245552b39eed32b334851bc6a1b8fa"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vdpau.c#L378"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-vdpau-hwaccel-bitstream-buffer-table"
}
],
"title": "FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125242",
"datePublished": "2026-11-09T19:11:50.739Z",
"dateReserved": "2026-11-09T18:15:27.311Z",
"dateUpdated": "2026-11-09T20:56:49.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125241 (GCVE-0-2026-125241)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 19:11
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr
Summary
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because check_pixel_ptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data past frame storage, corrupting heap memory to crash applications or possibly execute code.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25702 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/27f612b30… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because check_pixel_ptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data past frame storage, corrupting heap memory to crash applications or possibly execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:50.066Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25702"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/27f612b306eb04f81138173f705df9a9b055b01d"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/flicvideo.c#L63"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-flic-decoder-check-pixel-ptr"
}
],
"title": "FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125241",
"datePublished": "2026-11-09T19:11:50.066Z",
"dateReserved": "2026-11-09T18:15:26.990Z",
"dateUpdated": "2026-11-09T19:11:50.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}