{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3affmpegffmpeg/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125269"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (through 9.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.\u003c/p\u003e\n","date_modified":"2026-11-09T23:59:35Z","date_published":"2026-11-09T23:59:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-double-free/","summary":"FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c that allows heap memory corruption via crafted H.264 streams.","title":"FFmpeg: Heap memory corruption via double free vulnerability (CVE-2026-125269)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-double-free/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125260"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (\u003c= 9.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg versions 9.0.2 and earlier contain a heap buffer overflow vulnerability in the file libavcodec/exrenc.c. The flaw resides in the encode_scanline_rle() function. An attacker can trigger this vulnerability by providing a crafted input file that, when transcoded to OpenEXR with RLE compression, contains frame dimensions that exceed the encoder's initially configured height. This condition leads to an out-of-bounds write beyond the scanline array, resulting in heap memory corruption and application crashes.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an attacker to cause an application crash. While the source confirms heap memory corruption, it does not explicitly confirm remote code execution (RCE). The impact is primarily denial of service for any application utilizing FFmpeg to transcode media inputs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all systems and applications within the environment that utilize FFmpeg libraries.\u003c/li\u003e\n\u003cli\u003ePrioritize patching FFmpeg to a version beyond 9.0.2 once a secure version is made available by the maintainers.\u003c/li\u003e\n\u003cli\u003eImplement sandboxing or isolation for media processing services that handle untrusted, user-supplied files to contain potential crashes and exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T21:58:44Z","date_published":"2026-11-09T21:58:44Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-heap-overflow-3f17725c/","summary":"FFmpeg versions through 9.0.2 are vulnerable to a heap buffer overflow in libavcodec/exrenc.c that can cause memory corruption and application crashes during OpenEXR RLE encoding of frames exceeding initial height.","title":"FFmpeg: Heap buffer overflow in libavcodec (CVE-2026-125260)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-heap-overflow-3f17725c/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125249"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (7.1 through 9.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg 7.1 through 9.0.2 contains an integer overflow in the \u003ccode\u003eff_vk_decode_add_slice()\u003c/code\u003e function in \u003ccode\u003elibavcodec/vulkan_decode.c\u003c/code\u003e. This flaw causes a miscalculation of the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing \u003ccode\u003ememcpy()\u003c/code\u003e to write past a smaller pooled host-mapped buffer.\u003c/p\u003e\n","date_modified":"2026-11-09T19:56:11Z","date_published":"2026-11-09T19:56:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-vuln/","summary":"FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size.","title":"FFmpeg: Integer overflow in vulkan_decode.c (CVE-2026-125249)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-vuln/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125241"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (\u003c= 9.0.2)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-125241","heap-overflow","ffmpeg","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg versions through 9.0.2 contain a heap-based buffer overflow vulnerability in \u003ccode\u003elibavcodec/flicvideo.c\u003c/code\u003e. The flaw exists in the \u003ccode\u003echeck_pixel_ptr()\u003c/code\u003e function, which fails to correctly validate bounds when processing FLIC files containing negative-stride frames. An attacker can supply a specially crafted FLIC file to trigger an out-of-bounds write, leading to heap memory corruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in an application crash (denial of service) or the potential for arbitrary code execution within the context of the user running the FFmpeg-enabled application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems and software utilizing FFmpeg libraries.\u003c/li\u003e\n\u003cli\u003eMonitor for the release of patched versions of FFmpeg beyond 9.0.2 and prioritize updates for all affected integrations.\u003c/li\u003e\n\u003cli\u003eImplement memory safety mitigations at the compiler or OS level (e.g., ASLR, DEP) to reduce the likelihood of successful exploitation where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:55:56Z","date_published":"2026-11-09T19:55:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-cve-2026-125241/","summary":"FFmpeg versions 9.0.2 and earlier are vulnerable to a heap buffer overflow in the libavcodec/flicvideo.c component, which could allow remote code execution or application crashes via crafted FLIC files.","title":"FFmpeg: Heap buffer overflow in libavcodec/flicvideo.c (CVE-2026-125241)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-cve-2026-125241/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125227"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (\u003c= 9.0.2)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","ffmpeg","memory-corruption"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg through 9.0.2 contains an integer overflow in the cbs_jpeg_write_scan() function located in libavcodec/cbs_jpeg.c. This vulnerability is specifically triggered on 32-bit architectures when the application processes a crafted MJPEG or JPEG stream containing a scan size of 512 MiB or greater, handled by CBS bitstream filters such as filter_units. Exploitation results in heap buffer corruption or application crashes.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may lead to a denial of service (application crash) or potential memory corruption via heap buffer overflow. Impact is limited to 32-bit build environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems and applications utilizing FFmpeg versions 9.0.2 or earlier.\u003c/li\u003e\n\u003cli\u003ePrioritize migration from 32-bit to 64-bit builds of FFmpeg where possible, as the overflow condition is specific to 32-bit architectures.\u003c/li\u003e\n\u003cli\u003eMonitor for security updates from FFmpeg and apply patches once a version addressing CVE-2026-125227 is released.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:55:27Z","date_published":"2026-11-09T19:55:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-integer-overflow-93431ef6/","summary":"FFmpeg versions through 9.0.2 contain an integer overflow in the cbs_jpeg_write_scan function, leading to heap buffer overflows on 32-bit architectures when processing crafted MJPEG/JPEG streams.","title":"FFmpeg: Integer overflow in cbs_jpeg_write_scan (CVE-2026-125227)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-integer-overflow-93431ef6/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125222"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (\u003c= 9.0.2)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","ffmpeg","memory-corruption"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg through version 9.0.2 is vulnerable to an integer overflow within the hap_parse_frame_header() function located in libavcodec/hapdec.c. This flaw occurs when processing maliciously crafted Hap video frames that contain Snappy length prefixes. On 32-bit builds, these prefixes can trigger an integer wrap-around on the tex_size variable, subsequently leading to a heap buffer overflow in decompress_chunks_thread(). An attacker could potentially leverage this condition to cause an application crash or achieve arbitrary code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in an application crash (Denial of Service) or arbitrary code execution within the context of the user running the FFmpeg-dependent application. The vulnerability specifically impacts 32-bit environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit infrastructure to identify applications or services utilizing FFmpeg versions 9.0.2 or older.\u003c/li\u003e\n\u003cli\u003ePrioritize patching or updating FFmpeg-dependent software to versions utilizing patched FFmpeg libraries once available from upstream or distribution maintainers.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, implement strict input validation or sandboxing for untrusted video files processed by FFmpeg in 32-bit environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:55:21Z","date_published":"2026-11-09T19:55:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-integer-overflow/","summary":"FFmpeg versions through 9.0.2 contain an integer overflow vulnerability in the hap_parse_frame_header function, which can be exploited by a crafted Hap video frame to cause a heap buffer overflow and potential remote code execution on 32-bit systems.","title":"FFmpeg: Integer overflow in hap_parse_frame_header (CVE-2026-125222)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-integer-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125213"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (\u003c= 9.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg versions through 9.0.2 contain a heap buffer overflow vulnerability in the PSD decoder located in 'libavcodec/psd.c'. The issue occurs due to improper handling of image dimensions and channel counts on 32-bit builds, where the product of these values can exceed 4 GB. This triggers an integer truncation during the 'av_malloc' allocation, subsequently allowing 'decode_rle()' to write data beyond the allocated heap buffer boundaries.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in process crashes (denial of service) or potential arbitrary code execution under the context of the application utilizing the FFmpeg library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade FFmpeg to a version beyond 9.0.2 as soon as a patch is available.\u003c/li\u003e\n\u003cli\u003eImplement memory safety monitoring for applications using FFmpeg to process untrusted PSD files.\u003c/li\u003e\n\u003cli\u003eAudit infrastructure to identify applications utilizing 32-bit builds of the FFmpeg library.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:53:02Z","date_published":"2026-11-09T19:53:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-heap-overflow-e749998b/","summary":"FFmpeg versions through 9.0.2 are vulnerable to a heap buffer overflow in the PSD decoder, allowing remote attackers to achieve memory corruption or arbitrary code execution via crafted PSD images on 32-bit systems.","title":"FFmpeg: PSD decoder heap buffer overflow (CVE-2026-125213)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-heap-overflow-e749998b/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}