FFmpeg: Heap buffer overflow in libavcodec (CVE-2026-125260)

FFmpeg versions 9.0.2 and earlier contain a heap buffer overflow vulnerability in the file libavcodec/exrenc.c. The flaw resides in the encode_scanline_rle() function. An attacker can trigger this vulnerability by providing a crafted input file that, when transcoded to OpenEXR with RLE compression, contains frame dimensions that exceed the encoder's initially configured height. This condition leads to an out-of-bounds write beyond the scanline array, resulting in heap memory corruption and application crashes.

Impact

The vulnerability allows an attacker to cause an application crash. While the source confirms heap memory corruption, it does not explicitly confirm remote code execution (RCE). The impact is primarily denial of service for any application utilizing FFmpeg to transcode media inputs.

Recommendation

• Identify all systems and applications within the environment that utilize FFmpeg libraries.
• Prioritize patching FFmpeg to a version beyond 9.0.2 once a secure version is made available by the maintainers.
• Implement sandboxing or isolation for media processing services that handle untrusted, user-supplied files to contain potential crashes and exploitation attempts.