Cpe:2.3:a:ffmpeg:ffmpeg:::::::: - CraftedSignal Threat Feed

FFmpeg: Heap memory corruption via double free vulnerability (CVE-2026-125269)

hello@craftedsignal.io — Mon, 09 Nov 2026 23:59:35 +0000

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.

FFmpeg: Heap buffer overflow in libavcodec (CVE-2026-125260)

hello@craftedsignal.io — Mon, 09 Nov 2026 21:58:44 +0000

FFmpeg versions 9.0.2 and earlier contain a heap buffer overflow vulnerability in the file libavcodec/exrenc.c. The flaw resides in the encode_scanline_rle() function. An attacker can trigger this vulnerability by providing a crafted input file that, when transcoded to OpenEXR with RLE compression, contains frame dimensions that exceed the encoder's initially configured height. This condition leads to an out-of-bounds write beyond the scanline array, resulting in heap memory corruption and application crashes.

Impact

The vulnerability allows an attacker to cause an application crash. While the source confirms heap memory corruption, it does not explicitly confirm remote code execution (RCE). The impact is primarily denial of service for any application utilizing FFmpeg to transcode media inputs.

Recommendation

Identify all systems and applications within the environment that utilize FFmpeg libraries.
Prioritize patching FFmpeg to a version beyond 9.0.2 once a secure version is made available by the maintainers.
Implement sandboxing or isolation for media processing services that handle untrusted, user-supplied files to contain potential crashes and exploitation attempts.

FFmpeg: Integer overflow in vulkan_decode.c (CVE-2026-125249)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:56:11 +0000

FFmpeg 7.1 through 9.0.2 contains an integer overflow in the ff_vk_decode_add_slice() function in libavcodec/vulkan_decode.c. This flaw causes a miscalculation of the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.

FFmpeg: Heap buffer overflow in libavcodec/flicvideo.c (CVE-2026-125241)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:56 +0000

FFmpeg versions through 9.0.2 contain a heap-based buffer overflow vulnerability in libavcodec/flicvideo.c. The flaw exists in the check_pixel_ptr() function, which fails to correctly validate bounds when processing FLIC files containing negative-stride frames. An attacker can supply a specially crafted FLIC file to trigger an out-of-bounds write, leading to heap memory corruption.

Impact

Successful exploitation may result in an application crash (denial of service) or the potential for arbitrary code execution within the context of the user running the FFmpeg-enabled application.

Recommendation

Inventory systems and software utilizing FFmpeg libraries.
Monitor for the release of patched versions of FFmpeg beyond 9.0.2 and prioritize updates for all affected integrations.
Implement memory safety mitigations at the compiler or OS level (e.g., ASLR, DEP) to reduce the likelihood of successful exploitation where possible.

FFmpeg: Integer overflow in cbs_jpeg_write_scan (CVE-2026-125227)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:27 +0000

FFmpeg through 9.0.2 contains an integer overflow in the cbs_jpeg_write_scan() function located in libavcodec/cbs_jpeg.c. This vulnerability is specifically triggered on 32-bit architectures when the application processes a crafted MJPEG or JPEG stream containing a scan size of 512 MiB or greater, handled by CBS bitstream filters such as filter_units. Exploitation results in heap buffer corruption or application crashes.

Impact

Successful exploitation may lead to a denial of service (application crash) or potential memory corruption via heap buffer overflow. Impact is limited to 32-bit build environments.

Recommendation

Inventory systems and applications utilizing FFmpeg versions 9.0.2 or earlier.
Prioritize migration from 32-bit to 64-bit builds of FFmpeg where possible, as the overflow condition is specific to 32-bit architectures.
Monitor for security updates from FFmpeg and apply patches once a version addressing CVE-2026-125227 is released.

FFmpeg: Integer overflow in hap_parse_frame_header (CVE-2026-125222)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:21 +0000

FFmpeg through version 9.0.2 is vulnerable to an integer overflow within the hap_parse_frame_header() function located in libavcodec/hapdec.c. This flaw occurs when processing maliciously crafted Hap video frames that contain Snappy length prefixes. On 32-bit builds, these prefixes can trigger an integer wrap-around on the tex_size variable, subsequently leading to a heap buffer overflow in decompress_chunks_thread(). An attacker could potentially leverage this condition to cause an application crash or achieve arbitrary code execution.

Impact

Successful exploitation may result in an application crash (Denial of Service) or arbitrary code execution within the context of the user running the FFmpeg-dependent application. The vulnerability specifically impacts 32-bit environments.

Recommendation

Audit infrastructure to identify applications or services utilizing FFmpeg versions 9.0.2 or older.
Prioritize patching or updating FFmpeg-dependent software to versions utilizing patched FFmpeg libraries once available from upstream or distribution maintainers.
If immediate patching is not possible, implement strict input validation or sandboxing for untrusted video files processed by FFmpeg in 32-bit environments.

FFmpeg: PSD decoder heap buffer overflow (CVE-2026-125213)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:53:02 +0000

FFmpeg versions through 9.0.2 contain a heap buffer overflow vulnerability in the PSD decoder located in 'libavcodec/psd.c'. The issue occurs due to improper handling of image dimensions and channel counts on 32-bit builds, where the product of these values can exceed 4 GB. This triggers an integer truncation during the 'av_malloc' allocation, subsequently allowing 'decode_rle()' to write data beyond the allocated heap buffer boundaries.

Impact

Successful exploitation may result in process crashes (denial of service) or potential arbitrary code execution under the context of the application utilizing the FFmpeg library.

Recommendation

Upgrade FFmpeg to a version beyond 9.0.2 as soon as a patch is available.
Implement memory safety monitoring for applications using FFmpeg to process untrusted PSD files.
Audit infrastructure to identify applications utilizing 32-bit builds of the FFmpeg library.

Cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* - CraftedSignal Threat Feed

FFmpeg: Heap memory corruption via double free vulnerability (CVE-2026-125269)

FFmpeg: Heap buffer overflow in libavcodec (CVE-2026-125260)

Impact

Recommendation

FFmpeg: Integer overflow in vulkan_decode.c (CVE-2026-125249)

FFmpeg: Heap buffer overflow in libavcodec/flicvideo.c (CVE-2026-125241)

Impact

Recommendation

FFmpeg: Integer overflow in cbs_jpeg_write_scan (CVE-2026-125227)

Impact

Recommendation

FFmpeg: Integer overflow in hap_parse_frame_header (CVE-2026-125222)

Impact

Recommendation

FFmpeg: PSD decoder heap buffer overflow (CVE-2026-125213)

Impact

Recommendation

Cpe:2.3:a:ffmpeg:ffmpeg:::::::: - CraftedSignal Threat Feed