FFmpeg (7.1 Through 9.0.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ffmpeg-7.1-through-9.0.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 19:56:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFFmpeg: Integer overflow in vulkan_decode.c (CVE-2026-125249)https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-vuln/Mon, 09 Nov 2026 19:56:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ffmpeg-vuln/FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size.FFmpeg 7.1 through 9.0.2 contains an integer overflow in the ff_vk_decode_add_slice() function in libavcodec/vulkan_decode.c. This flaw causes a miscalculation of the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.

]]>highadvisory