FFmpeg vulnerabilities and threats

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the pcm_rechunk bitstream filter. This flaw allows attackers to cause a division by zero error by providing a crafted file with an excessively large channel count. The vulnerability leads to an overflow of the sample_size variable and results in application crashes during remuxing into MXF, GXF, or DAUD formats.

CVE-2026-125229 is a high-severity out-of-bounds memory access vulnerability in FFmpeg versions up to 9.0.2. It occurs in the encode_frame() function of libavcodec/huffyuvenc.c due to insufficient validation of minimum frame dimensions in encode_init(). This allows crafted tiny video frames to cause negative length calculations, leading to out-of-bounds reads and writes that crash the encoder.

CVE-2026-125228 is an out-of-bounds read vulnerability in FFmpeg's Vorbis encoder affecting versions before 8.1.3 and 9.x before 9.0.2. The flaw occurs when NaN float samples cause the codebook entry to be set to -1, leading to heap reads before arrays. This can cause application crashes or leakage of adjacent heap memory into output.

CVE-2026-125227 is an integer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the cbs_jpeg_write_scan() function within libavcodec/cbs_jpeg.c, leading to a heap buffer overflow on 32-bit builds when processing crafted MJPEG/JPEG streams with large scans. This can cause heap corruption or application crashes.

CVE-2026-125226 is a vulnerability in FFmpeg up to version 9.0.2 where the sbg_read_header() function in the wavesynth decoder improperly handles memory allocation. By supplying a crafted SBaGen script with an excessively high sample rate (-r), an attacker can cause the decoder to allocate very large audio frames, leading to memory exhaustion and denial of service.

CVE-2026-125225 is a vulnerability in FFmpeg versions up to 9.0.2 involving a NULL pointer dereference in the aac_adtstoasc_filter() function. This flaw allows attackers to crash applications by supplying crafted ADTS AAC packets larger than 256 MB, causing unchecked failures in bit count initialization and subsequent crashes during remuxing of MP4, Matroska, FLV, or LATM files.

CVE-2026-125224 is a denial of service vulnerability in FFmpeg versions up to 9.0.2. It occurs in the libavcodec/vorbis_parser.c component, where invalid extradata is re-parsed for every packet if valid_extradata remains false. Crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets can exhaust CPU resources during demuxing or probing.

A memory leak vulnerability exists in FFmpeg versions 8.0 through 9.0.2 in the VP9 decoder. The issue arises because the function vp9_decode_frame() does not reset the CBS fragment on error paths, leading to leaked packet buffers and units when decoding crafted VP9 streams with invalid tile sizes using slice threading. This can cause memory exhaustion in the decoding application.

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the hap_parse_frame_header() function within libavcodec/hapdec.c. This flaw allows crafted Hap video frames with Snappy length prefixes to cause a heap buffer overflow on 32-bit builds, potentially leading to application crashes or code execution.

CVE-2026-125221 is a vulnerability in FFmpeg versions up to 9.0.2 involving uncontrolled recursion in the score_header() function within libavcodec/flac_parser.c. This flaw allows an attacker to craft a FLAC audio stream with many small valid-looking frame headers, causing deep recursion that exhausts the thread stack and crashes the process during demuxing or parsing.

A deadlock vulnerability exists in FFmpeg versions up to 9.0.2 in the mimic_decode_frame() function within libavcodec/mimic.c. This flaw occurs when init_get_bits8() fails to report frame progress, allowing an attacker to supply a crafted file with an oversized Mimic intra frame followed by inter frames, causing frame-threaded decoding to hang indefinitely.

CVE-2026-125219 is a heap buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the vdpau_hevc_start_frame() function when processing HEVC bitstreams with excessive tile columns or rows, leading to out-of-bounds writes in fixed-size VDPAU arrays. This memory corruption can affect applications using VDPAU decoding.

CVE-2026-125218 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the APNG encoder's encode_apng() function when the frame size changes mid-stream, allowing crafted media with increasing resolution to cause out-of-bounds memory writes. This can lead to application crashes or heap memory corruption during transcoding.

CVE-2026-125217 is a medium-severity vulnerability in FFmpeg versions up to 9.0.2. It involves the use of uninitialized memory in the roq_dpcm_encode_frame() function, which can cause stale heap data to be encoded and leaked into output audio packets when processing short RoQ DPCM audio streams under eight frames.

A NULL pointer dereference vulnerability exists in FFmpeg through version 9.0.2 in the libavcodec/dpxenc.c component. This flaw occurs when processing certain 12-bit RGB images, such as JPEG 2000, that trigger a dereference of NULL plane pointers during transcoding to DPX format, leading to a denial of service via process crash.

A NULL pointer dereference vulnerability exists in FFmpeg versions 7.1 through 9.0.2 within the ff_dovi_rpu_generate() function in libavcodec/dovi_rpuenc.c. This flaw can be triggered by crafted Dolby Vision RPU metadata streams, specifically when using the dovi_rpu bitstream filter with compression enabled. Exploitation results in application crashes, causing denial of service.

FFmpeg versions up to 9.0.2 contain a heap-based buffer overflow vulnerability in the pcm_bluray_decode_frame() function on big-endian hosts. This flaw occurs when processing crafted Blu-ray LPCM streams with payload lengths not aligned to the sample size, allowing out-of-bounds writes past the audio frame buffer.

CVE-2026-125213 is a heap buffer overflow vulnerability in FFmpeg's PSD decoder affecting versions up to 9.0.2. It occurs on 32-bit builds when processing crafted PSD images with dimensions and channel counts whose product exceeds 4 GB, causing numeric truncation of the allocation size. This leads to out-of-bounds writes, potentially resulting in crashes or code execution.

CVE-2026-125212 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the VideoToolbox encoder component when frames larger than the encoder's configured dimensions are copied into undersized buffers. This can happen if an attacker supplies input whose resolution increases mid-stream without proper rescaling, potentially causing application crashes or memory corruption.

CVE-2026-125211 is a high-severity vulnerability in FFmpeg versions up to 9.0.2. It involves an out-of-bounds read and invalid free in the aribcaption_trans_ass_subtitle() function, where subtitle rectangles are freed incorrectly, leading to heap corruption. This occurs when processing crafted ARIB captions that exceed an internal buffer limit.