CVE-2026-125250 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the GIF encoder's gif_image_write_image() function due to incorrect sizing of an internal buffer based on the first frame's linesize. Attackers can exploit this by providing PAL8 video with a frame linesize that increases mid-stream, leading to out-of-bounds writes and heap corruption during GIF transcoding.
CVE-2026-125249 is an integer overflow vulnerability in FFmpeg versions 7.1 through 9.0.2 within the Vulkan hardware acceleration decoding component. The flaw occurs in the ff_vk_decode_add_slice() function, which miscalculates the bitstream buffer size, allowing an attacker to supply a crafted stream with over 2 GiB of slice data per frame. This can cause a buffer overflow via memcpy() writing beyond the allocated buffer.
FFmpeg versions 9.0 through 9.0.2 contain an integer overflow vulnerability in the Vulkan encoder component. This flaw causes undersizing of the float remap GPU buffer for large frames, which can lead to out-of-bounds GPU memory writes when processing certain large image or video formats. Exploitation may result in crashes or memory corruption during transcoding.
CVE-2026-125247 is an integer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the dng_decode_tiles() function when processing crafted DNG tile dimensions, allowing attackers to leak uninitialized or stale heap memory by setting TileWidth or TileLength near the integer maximum value. This can cause the tile loop to never run, resulting in memory exposure.
CVE-2026-125246 is a denial of service vulnerability in FFmpeg versions up to 9.0.2. It occurs in the cbs_jpeg_assemble_fragment() function, which miscounts 0xff stuffing bytes in JPEG scan headers. A crafted JPEG or MJPEG stream containing 0xff bytes in the scan header can trigger an assertion failure, causing the application to abort.
CVE-2026-125245 is a memory leak vulnerability in FFmpeg versions up to 9.0.2. The flaw occurs in the ff_mjpeg_decode_sof() function of the MJPEG decoder, where the hwaccel_picture_private pointer is overwritten without being freed. This can lead to leakage of private hardware acceleration data and buffers when processing crafted MJPEG streams with repeated SOF markers or failing frames under VAAPI or NVDEC decoding.
CVE-2026-125244 is an out-of-bounds write vulnerability in FFmpeg's VVC decoder affecting versions before 8.1.3 and 9.x before 9.0.2. The flaw occurs in the sh_entry_points() function when processing crafted VVC (H.266) bitstreams with specific SPS/PPS tile and WPP layouts, leading to memory corruption in the decoder.
CVE-2026-125243 is a medium severity vulnerability in FFmpeg up to version 9.0.2. It involves an uninitialized memory disclosure in the JPEG-LS decoder component, specifically in ff_jpegls_decode_picture(). A crafted single-component JPEG-LS image with the ILV byte set to 1 can cause decoded GRAY16 frames to leak leftover heap memory.
CVE-2026-125242 is a medium severity memory leak vulnerability in FFmpeg versions up to 9.0.2. It occurs in the libavcodec/vdpau.c component when processing crafted H.264 streams with malformed NAL units that abort pictures before the end_frame. This causes continuous leakage of heap memory, potentially leading to denial of service.
CVE-2026-125241 is a heap buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the libavcodec/flicvideo.c component due to insufficient bounds checking in the check_pixel_ptr() function when processing negative-stride frames. An attacker can craft a malicious FLIC file with specially designed RLE and delta chunks that write pixel data beyond allocated frame storage, leading to heap memory corruption. This can cause application crashes or potentially allow code execution.
CVE-2026-125240 is a resource leak vulnerability in FFmpeg versions 8.1 through 9.0.2. It occurs in the svt_jpegxs_dec_decode() function when ff_set_dimensions() rejects frame dimensions, causing decoder instances to leak memory. An attacker can exploit this by supplying a crafted JPEG XS stream with oversized headers, leading to repeated memory exhaustion.
CVE-2026-125239 is a heap buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the function ff_dxva2_hevc_fill_picture_parameters() when processing HEVC bitstreams with many non-uniformly spaced tiles. This flaw allows attackers to corrupt memory by writing controlled 16-bit values beyond fixed-size DXVA arrays during hardware-accelerated video decoding on Windows platforms.
CVE-2026-125238 is a reachable assertion vulnerability in FFmpeg versions 7.0 through 9.0.2. The flaw exists in the libxevd_receive_frame() function within libavcodec/libxevd.c, where the code returns success even when an access unit produces no frame. An attacker can craft a malicious EVC file with truncated or picture-less access units to trigger an assertion failure, causing the decoding application to abort.
CVE-2026-125237 is a denial of service vulnerability in FFmpeg versions 8.1 through 9.0.2. It occurs in the libavcodec/dpx.c component when Vulkan hardware acceleration callbacks fail, leaving allocated memory that triggers an assertion failure on subsequent frames. This causes the decoding application to abort unexpectedly when processing crafted DPX images.
CVE-2026-125236 is a memory leak vulnerability in FFmpeg versions up to 9.0.2. It occurs in the alloc_frame() function within libavcodec/vvc/refs.c, where SPS and PPS references are not released properly when frame buffer allocation fails. An attacker can exploit this by supplying a crafted VVC (H.266) video stream that repeatedly replaces parameter sets, causing memory usage to grow steadily and potentially leading to denial of service.
CVE-2026-125235 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. The flaw exists in the libavcodec/qsvenc.c component and occurs when an undersized pooled QSVFrame buffer is reused as input video dimensions increase mid-stream. This can lead to memory corruption or application crashes when transcoding with Intel Quick Sync encoders without rescaling.
CVE-2026-125234 is an integer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the wavpack_encode_init() function within libavcodec/wavpackenc.c, causing an infinite loop when calculating block size from sample rate and channel count. An attacker can exploit this by providing a crafted audio file with an abnormally large sample rate and many channels, potentially causing applications transcoding to WavPack to hang.
FFmpeg versions up to 9.0.2 have a heap buffer overflow vulnerability in the dvbsub_encode() function of libavcodec/dvbsubenc.c. This flaw arises from an incorrect calculation of buffer size, where each CLUT segment header is undercounted by two bytes. An attacker can exploit this by providing a specially crafted file with many bitmap subtitle rectangles, causing a heap overflow during transcoding and potential heap memory corruption.
CVE-2026-125232 is a division by zero vulnerability in FFmpeg versions up to 9.0.2. It occurs in the estimate_motion_b() function within libavcodec/motion_est.c due to frame timestamp distances truncated to 16 bits. Maliciously crafted input with timestamp gaps that are multiples of 65536 can cause the encoder to crash with a SIGFPE signal during MPEG-4 Part 2 or MPEG-1/2 B-frame encoding.
A NULL pointer dereference vulnerability exists in FFmpeg versions 4.4 through 9.0.2 in the ADX audio decoder. This occurs because the function adx_decode_header() updates the channel layout before validating the sample rate, allowing crafted ADX/AAX streams with invalid sample rates to cause a crash.