FFmpeg: Integer overflow in cbs_jpeg_write_scan (CVE-2026-125227)
FFmpeg versions through 9.0.2 contain an integer overflow in the cbs_jpeg_write_scan function, leading to heap buffer overflows on 32-bit architectures when processing crafted MJPEG/JPEG streams.
CVE search metadata
CVE search record: CVE-2026-125227. Severity: high. CVSS: 7.0. KEV: no. Product: FFmpeg (<= 9.0.2). Brief: FFmpeg: Integer overflow in cbs_jpeg_write_scan (CVE-2026-125227). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-integer-overflow-93431ef6/
Triage facts
Revision 1- Applicability
- FFmpeg (<= 9.0.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 19:55 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
FFmpeg through 9.0.2 contains an integer overflow in the cbs_jpeg_write_scan() function located in libavcodec/cbs_jpeg.c. This vulnerability is specifically triggered on 32-bit architectures when the application processes a crafted MJPEG or JPEG stream containing a scan size of 512 MiB or greater, handled by CBS bitstream filters such as filter_units. Exploitation results in heap buffer corruption or application crashes.
Impact
Successful exploitation may lead to a denial of service (application crash) or potential memory corruption via heap buffer overflow. Impact is limited to 32-bit build environments.
Recommendation
- Inventory systems and applications utilizing FFmpeg versions 9.0.2 or earlier.
- Prioritize migration from 32-bit to 64-bit builds of FFmpeg where possible, as the overflow condition is specific to 32-bit architectures.
- Monitor for security updates from FFmpeg and apply patches once a version addressing CVE-2026-125227 is released.
Immediate actions
Identify and inventory all 32-bit FFmpeg deployments within the environment
Threat Hunt
Identify applications performing intensive video processing or stream decoding using 32-bit libraries
Data: Application crash logs, Library dependency inventory
Mitigations
Upgrade affected FFmpeg installations to a version where this integer overflow is resolved
CVE-2026-125227