{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3affmpegffmpeg9.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg:9.0.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125248"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (9.0 through 9.0.2)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","ffmpeg","memory-corruption"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg versions 9.0 through 9.0.2 contain an integer overflow vulnerability within \u003ccode\u003elibavcodec/ffv1enc_vulkan.c\u003c/code\u003e. The vulnerability manifests when the software attempts to allocate memory for the float remap GPU buffer. Supplying a large GBRPF32 or GBRAPF32 image or video for transcoding into the FFV1 format via the Vulkan encoder results in an undersized buffer allocation. This leads to an out-of-bounds GPU memory write, which can result in application crashes or memory corruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in a denial of service (application crash) or potential memory corruption on the host system running the transcoding process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems and applications utilizing FFmpeg libraries to identify exposure to versions 9.0 through 9.0.2.\u003c/li\u003e\n\u003cli\u003eUpdate FFmpeg to a patched version once released by the vendor.\u003c/li\u003e\n\u003cli\u003eRestrict the use of the Vulkan encoder in untrusted transcoding pipelines until the software is updated.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:56:07Z","date_published":"2026-11-09T19:56:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-overflow/","summary":"An integer overflow in the FFmpeg Vulkan encoder (libavcodec/ffv1enc_vulkan.c) allows remote attackers to cause memory corruption or application crashes through specially crafted high-resolution image or video files.","title":"FFmpeg: Integer overflow in Vulkan encoder (CVE-2026-125248)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ffmpeg:ffmpeg:9.0.2:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}