FFmpeg: PSD decoder heap buffer overflow (CVE-2026-125213)
FFmpeg versions through 9.0.2 are vulnerable to a heap buffer overflow in the PSD decoder, allowing remote attackers to achieve memory corruption or arbitrary code execution via crafted PSD images on 32-bit systems.
CVE search metadata
CVE search record: CVE-2026-125213. Severity: high. CVSS: 7.0. KEV: no. Product: FFmpeg (<= 9.0.2). Brief: FFmpeg: PSD decoder heap buffer overflow (CVE-2026-125213). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-heap-overflow-e749998b/
Triage facts
Revision 1- Applicability
- FFmpeg (<= 9.0.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 19:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
FFmpeg versions through 9.0.2 contain a heap buffer overflow vulnerability in the PSD decoder located in 'libavcodec/psd.c'. The issue occurs due to improper handling of image dimensions and channel counts on 32-bit builds, where the product of these values can exceed 4 GB. This triggers an integer truncation during the 'av_malloc' allocation, subsequently allowing 'decode_rle()' to write data beyond the allocated heap buffer boundaries.
Impact
Successful exploitation may result in process crashes (denial of service) or potential arbitrary code execution under the context of the application utilizing the FFmpeg library.
Recommendation
- Upgrade FFmpeg to a version beyond 9.0.2 as soon as a patch is available.
- Implement memory safety monitoring for applications using FFmpeg to process untrusted PSD files.
- Audit infrastructure to identify applications utilizing 32-bit builds of the FFmpeg library.
Immediate actions
Identify applications in the environment using 32-bit FFmpeg libraries.
Threat Hunt
Monitor for application crashes involving ffmpeg processes or libraries when handling image files.
Data: Application crash logs, Process memory dumps
Mitigations
Upgrade FFmpeg to a patched version beyond 9.0.2.
CVE-2026-125213