Cpe:2.3:a:ffmpeg:ffmpeg:9.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3affmpegffmpeg9.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 19:56:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFFmpeg: Integer overflow in Vulkan encoder (CVE-2026-125248)https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-overflow/Mon, 09 Nov 2026 19:56:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ffmpeg-overflow/An integer overflow in the FFmpeg Vulkan encoder (libavcodec/ffv1enc_vulkan.c) allows remote attackers to cause memory corruption or application crashes through specially crafted high-resolution image or video files.FFmpeg versions 9.0 through 9.0.2 contain an integer overflow vulnerability within libavcodec/ffv1enc_vulkan.c. The vulnerability manifests when the software attempts to allocate memory for the float remap GPU buffer. Supplying a large GBRPF32 or GBRAPF32 image or video for transcoding into the FFV1 format via the Vulkan encoder results in an undersized buffer allocation. This leads to an out-of-bounds GPU memory write, which can result in application crashes or memory corruption.

Impact

Successful exploitation may result in a denial of service (application crash) or potential memory corruption on the host system running the transcoding process.

Recommendation

  • Inventory systems and applications utilizing FFmpeg libraries to identify exposure to versions 9.0 through 9.0.2.
  • Update FFmpeg to a patched version once released by the vendor.
  • Restrict the use of the Vulkan encoder in untrusted transcoding pipelines until the software is updated.
]]>highadvisoryvulnerabilityffmpegmemory-corruption