Threats affecting pkg:generic/espeak-ng

CVE-2026-125218 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the APNG encoder's encode_apng() function when the frame size changes mid-stream, allowing crafted media with increasing resolution to cause out-of-bounds memory writes. This can lead to application crashes or heap memory corruption during transcoding.

CVE-2026-125217 is a medium-severity vulnerability in FFmpeg versions up to 9.0.2. It involves the use of uninitialized memory in the roq_dpcm_encode_frame() function, which can cause stale heap data to be encoded and leaked into output audio packets when processing short RoQ DPCM audio streams under eight frames.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service.

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service.

FFmpeg versions up to 9.0.2 contain a heap-based buffer overflow vulnerability in the pcm_bluray_decode_frame() function on big-endian hosts. This flaw occurs when processing crafted Blu-ray LPCM streams with payload lengths not aligned to the sample size, allowing out-of-bounds writes past the audio frame buffer.

CVE-2026-125213 is a heap buffer overflow vulnerability in FFmpeg's PSD decoder affecting versions up to 9.0.2. It occurs on 32-bit builds when processing crafted PSD images with dimensions and channel counts whose product exceeds 4 GB, causing numeric truncation of the allocation size. This leads to out-of-bounds writes, potentially resulting in crashes or code execution.

CVE-2026-125212 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the VideoToolbox encoder component when frames larger than the encoder's configured dimensions are copied into undersized buffers. This can happen if an attacker supplies input whose resolution increases mid-stream without proper rescaling, potentially causing application crashes or memory corruption.

CVE-2026-125211 is a high-severity vulnerability in FFmpeg versions up to 9.0.2. It involves an out-of-bounds read and invalid free in the aribcaption_trans_ass_subtitle() function, where subtitle rectangles are freed incorrectly, leading to heap corruption. This occurs when processing crafted ARIB captions that exceed an internal buffer limit.

FFmpeg versions up to 9.0.2 have a heap buffer overflow vulnerability in the aribcaption_trans_text_subtitle() function when decoding ARIB STD-B24 caption streams with zero regions. This flaw allows crafted input to cause a pointer write beyond allocated memory, leading to heap corruption.

CVE-2026-125209 is a heap buffer overflow vulnerability in FFmpeg's DVD subtitle encoder affecting versions before 8.1.3 and 9.x before 9.0.2. The flaw arises from incorrect calculation of the run-length encoding (RLE) output size for odd-width rectangles, allowing crafted bitmap subtitles to cause heap memory corruption during transcoding.

FFmpeg versions up to 9.0.2 contain an out-of-bounds write vulnerability in the v4l2_buffer_swframe_to_buf() function due to improper checking of cumulative plane offsets against the V4L2 buffer length. This flaw can cause a memory write beyond the mapped driver buffer during V4L2 M2M encoding when processing crafted video inputs with specific dimensions or padding.

FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decode_init() allocate nearly a gigabyte and deny service.

CVE-2026-125206 is a low-severity buffer under-read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the prores_ks encoder's get_alpha_data() function when processing interlaced ProRes 4444 video frames with alpha channel and odd heights. This flaw causes out-of-bounds memory to be read and encoded into the output alpha plane.

FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service.

A heap-based buffer overflow vulnerability exists in FFmpeg versions up to 9.0.2 in the ff_libwebp_get_frame() function. This flaw allows attackers to corrupt memory by supplying crafted media that increases resolution mid-stream, causing out-of-bounds writes and potential application crashes.

CVE-2026-125203 is a heap buffer overflow vulnerability in FFmpeg's Cook multichannel decoder affecting versions before 8.1.3 and 9.x before 9.0.2. The flaw arises from improper verification of overlapping subpacket channel masks in crafted RealMedia Cook streams, leading to out-of-bounds writes during decoding.

CVE-2026-125202 is a heap buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the vaapi_hevc_start_frame() function when processing HEVC bitstreams with large pictures and many tiles, leading to out-of-bounds writes in fixed-size arrays. This can corrupt memory in applications using VAAPI for hardware-accelerated decoding.

CVE-2026-125201 is a heap out-of-bounds write vulnerability in FFmpeg's Vulkan AV1 decoder. It affects FFmpeg versions 7.0 up to but not including 8.1.3, and 9.0 up to but not including 9.0.2. The flaw occurs because the tile-count limit is only checked on entry, allowing an attacker to supply a crafted AV1 stream with more than 256 tiles, which can overflow tile_sizes and corrupt heap memory.

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload allocated by ff_dovi_rpu_generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265 transcoding, causing unbounded memory growth and denial of service.

FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decode_frame() in libavcodec/vc1dec.c that leaks slice buffers when init_get_bits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory of decoding applications.