FFmpeg (<= 9.0.2) - CraftedSignal Threat Feed

FFmpeg: Integer overflow in ff_prores_kostya_encode_init (CVE-2026-125259)

hello@craftedsignal.io — Mon, 09 Nov 2026 23:59:17 +0000

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the ff_prores_kostya_encode_init() function caused by 32-bit arithmetic miscalculating frame_size_upper_bound for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder, which causes encode_frame() to write slices past an undersized packet buffer, leading to heap memory corruption.

FFmpeg: Heap buffer overflow in libavcodec (CVE-2026-125260)

hello@craftedsignal.io — Mon, 09 Nov 2026 21:58:44 +0000

FFmpeg versions 9.0.2 and earlier contain a heap buffer overflow vulnerability in the file libavcodec/exrenc.c. The flaw resides in the encode_scanline_rle() function. An attacker can trigger this vulnerability by providing a crafted input file that, when transcoded to OpenEXR with RLE compression, contains frame dimensions that exceed the encoder's initially configured height. This condition leads to an out-of-bounds write beyond the scanline array, resulting in heap memory corruption and application crashes.

Impact

The vulnerability allows an attacker to cause an application crash. While the source confirms heap memory corruption, it does not explicitly confirm remote code execution (RCE). The impact is primarily denial of service for any application utilizing FFmpeg to transcode media inputs.

Recommendation

Identify all systems and applications within the environment that utilize FFmpeg libraries.
Prioritize patching FFmpeg to a version beyond 9.0.2 once a secure version is made available by the maintainers.
Implement sandboxing or isolation for media processing services that handle untrusted, user-supplied files to contain potential crashes and exploitation attempts.

FFmpeg: VVC decoder heap-based memory corruption (CVE-2026-125251)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:56:24 +0000

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC (H.266) decoder alloc_frame() function in libavcodec/vvc/refs.c. This flaw undersizes the reference picture list allocation on 32-bit builds. An attacker can provide a crafted VVC file with a large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.

FFmpeg: Heap buffer overflow in libavcodec/flicvideo.c (CVE-2026-125241)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:56 +0000

FFmpeg versions through 9.0.2 contain a heap-based buffer overflow vulnerability in libavcodec/flicvideo.c. The flaw exists in the check_pixel_ptr() function, which fails to correctly validate bounds when processing FLIC files containing negative-stride frames. An attacker can supply a specially crafted FLIC file to trigger an out-of-bounds write, leading to heap memory corruption.

Impact

Successful exploitation may result in an application crash (denial of service) or the potential for arbitrary code execution within the context of the user running the FFmpeg-enabled application.

Recommendation

Inventory systems and software utilizing FFmpeg libraries.
Monitor for the release of patched versions of FFmpeg beyond 9.0.2 and prioritize updates for all affected integrations.
Implement memory safety mitigations at the compiler or OS level (e.g., ASLR, DEP) to reduce the likelihood of successful exploitation where possible.

FFmpeg: Heap buffer overflow in ff_dxva2_hevc_fill_picture_parameters (CVE-2026-125239)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:50 +0000

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the function ff_dxva2_hevc_fill_picture_parameters(). Attackers can supply crafted HEVC bitstreams with many non-uniformly spaced tiles to write controlled 16-bit values past fixed-size DXVA arrays. This issue occurs during DXVA2, D3D11VA, or D3D12VA decoding on Windows.

FFmpeg: Heap buffer overflow in dvbsub_encode (CVE-2026-125233)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:37 +0000

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub_encode() in libavcodec/dvbsubenc.c. The vulnerability occurs because the code undercounts each CLUT segment header by two bytes.

Impact

Attackers can supply a file with many bitmap subtitle rectangles that, when transcoded to the dvbsub encoder, writes past the output buffer and corrupts heap memory.

FFmpeg: Integer overflow in cbs_jpeg_write_scan (CVE-2026-125227)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:27 +0000

FFmpeg through 9.0.2 contains an integer overflow in the cbs_jpeg_write_scan() function located in libavcodec/cbs_jpeg.c. This vulnerability is specifically triggered on 32-bit architectures when the application processes a crafted MJPEG or JPEG stream containing a scan size of 512 MiB or greater, handled by CBS bitstream filters such as filter_units. Exploitation results in heap buffer corruption or application crashes.

Impact

Successful exploitation may lead to a denial of service (application crash) or potential memory corruption via heap buffer overflow. Impact is limited to 32-bit build environments.

Recommendation

Inventory systems and applications utilizing FFmpeg versions 9.0.2 or earlier.
Prioritize migration from 32-bit to 64-bit builds of FFmpeg where possible, as the overflow condition is specific to 32-bit architectures.
Monitor for security updates from FFmpeg and apply patches once a version addressing CVE-2026-125227 is released.

FFmpeg: Integer overflow in hap_parse_frame_header (CVE-2026-125222)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:21 +0000

FFmpeg through version 9.0.2 is vulnerable to an integer overflow within the hap_parse_frame_header() function located in libavcodec/hapdec.c. This flaw occurs when processing maliciously crafted Hap video frames that contain Snappy length prefixes. On 32-bit builds, these prefixes can trigger an integer wrap-around on the tex_size variable, subsequently leading to a heap buffer overflow in decompress_chunks_thread(). An attacker could potentially leverage this condition to cause an application crash or achieve arbitrary code execution.

Impact

Successful exploitation may result in an application crash (Denial of Service) or arbitrary code execution within the context of the user running the FFmpeg-dependent application. The vulnerability specifically impacts 32-bit environments.

Recommendation

Audit infrastructure to identify applications or services utilizing FFmpeg versions 9.0.2 or older.
Prioritize patching or updating FFmpeg-dependent software to versions utilizing patched FFmpeg libraries once available from upstream or distribution maintainers.
If immediate patching is not possible, implement strict input validation or sandboxing for untrusted video files processed by FFmpeg in 32-bit environments.

FFmpeg: Heap buffer overflow in vdpau_hevc_start_frame (CVE-2026-125219)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:55:15 +0000

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vdpau_hevc_start_frame() in libavcodec/vdpau_hevc.c that copies unbounded PPS tile counts into fixed-size VDPAU arrays. Attackers can supply crafted HEVC bitstreams with excessive tile columns or rows to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications using VDPAU decoding.

FFmpeg: PSD decoder heap buffer overflow (CVE-2026-125213)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:53:02 +0000

FFmpeg versions through 9.0.2 contain a heap buffer overflow vulnerability in the PSD decoder located in 'libavcodec/psd.c'. The issue occurs due to improper handling of image dimensions and channel counts on 32-bit builds, where the product of these values can exceed 4 GB. This triggers an integer truncation during the 'av_malloc' allocation, subsequently allowing 'decode_rle()' to write data beyond the allocated heap buffer boundaries.

Impact

Successful exploitation may result in process crashes (denial of service) or potential arbitrary code execution under the context of the application utilizing the FFmpeg library.

Recommendation

Upgrade FFmpeg to a version beyond 9.0.2 as soon as a patch is available.
Implement memory safety monitoring for applications using FFmpeg to process untrusted PSD files.
Audit infrastructure to identify applications utilizing 32-bit builds of the FFmpeg library.

FFmpeg: Heap buffer overflow in liboapve_encode (CVE-2026-125196)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:52:02 +0000

FFmpeg versions through 9.0.2 contain a heap buffer overflow vulnerability in the liboapve_encode() function located in libavcodec/liboapvenc.c. The vulnerability is triggered when processing frames larger than the configured encoder dimensions. Attackers can craft video files with mid-stream resolution changes so that transcoding to APV without rescaling writes pixel data past the imgb plane buffers, resulting in heap memory corruption.