Threats affecting pkg:generic/espeak-ng

CVE-2026-125235 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. The flaw exists in the libavcodec/qsvenc.c component and occurs when an undersized pooled QSVFrame buffer is reused as input video dimensions increase mid-stream. This can lead to memory corruption or application crashes when transcoding with Intel Quick Sync encoders without rescaling.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack_encode_init() in libavcodec/wavpackenc.c that causes an infinite loop when computing block size from sample rate and channel count. Attackers can supply a crafted audio file, such as a WAV header declaring a huge sample rate with many channels, to hang applications transcoding to WavPack.

FFmpeg versions up to 9.0.2 have a heap buffer overflow vulnerability in the dvbsub_encode() function of libavcodec/dvbsubenc.c. This flaw arises from an incorrect calculation of buffer size, where each CLUT segment header is undercounted by two bytes. An attacker can exploit this by providing a specially crafted file with many bitmap subtitle rectangles, causing a heap overflow during transcoding and potential heap memory corruption.

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adx_decode() to write through NULL plane pointers and crash the application.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into MXF, GXF or DAUD, overflowing sample_size and crashing the application.

CVE-2026-125229 is a high-severity out-of-bounds memory access vulnerability in FFmpeg versions up to 9.0.2. It occurs in the encode_frame() function of libavcodec/huffyuvenc.c due to insufficient validation of minimum frame dimensions in encode_init(). This allows crafted tiny video frames to cause negative length calculations, leading to out-of-bounds reads and writes that crash the encoder.

CVE-2026-125228 is an out-of-bounds read vulnerability in FFmpeg's Vorbis encoder affecting versions before 8.1.3 and 9.x before 9.0.2. The flaw occurs when NaN float samples cause the codebook entry to be set to -1, leading to heap reads before arrays. This can cause application crashes or leakage of adjacent heap memory into output.

CVE-2026-125227 is an integer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the cbs_jpeg_write_scan() function within libavcodec/cbs_jpeg.c, leading to a heap buffer overflow on 32-bit builds when processing crafted MJPEG/JPEG streams with large scans. This can cause heap corruption or application crashes.

FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an unbounded default frame size from the script's sample rate. Attackers can supply a crafted SBaGen script declaring a very high -r sample rate so the wavesynth decoder allocates enormous audio frames, exhausting memory and causing denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so init_get_bits() fails unchecked and get_bits() crashes during MP4, Matroska, FLV or LATM remuxing.

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every packet when valid_extradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CPU during demuxing or probing.

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the hap_parse_frame_header() function within libavcodec/hapdec.c. This flaw allows crafted Hap video frames with Snappy length prefixes to cause a heap buffer overflow on 32-bit builds, potentially leading to application crashes or code execution.

FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looking frame headers, forcing deep recursion that crashes the process during demuxing or parsing.

FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress when init_get_bits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinitely.

CVE-2026-125219 is a heap buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the vdpau_hevc_start_frame() function when processing HEVC bitstreams with excessive tile columns or rows, leading to out-of-bounds writes in fixed-size VDPAU arrays. This memory corruption can affect applications using VDPAU decoding.

CVE-2026-125218 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the APNG encoder's encode_apng() function when the frame size changes mid-stream, allowing crafted media with increasing resolution to cause out-of-bounds memory writes. This can lead to application crashes or heap memory corruption during transcoding.

CVE-2026-125217 is a medium-severity vulnerability in FFmpeg versions up to 9.0.2. It involves the use of uninitialized memory in the roq_dpcm_encode_frame() function, which can cause stale heap data to be encoded and leaked into output audio packets when processing short RoQ DPCM audio streams under eight frames.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service.