FFmpeg vulnerabilities and threats

FFmpeg versions up to 9.0.2 have a heap buffer overflow vulnerability in the aribcaption_trans_text_subtitle() function when decoding ARIB STD-B24 caption streams with zero regions. This flaw allows crafted input to cause a pointer write beyond allocated memory, leading to heap corruption.

CVE-2026-125209 is a heap buffer overflow vulnerability in FFmpeg's DVD subtitle encoder affecting versions before 8.1.3 and 9.x before 9.0.2. The flaw arises from incorrect calculation of the run-length encoding (RLE) output size for odd-width rectangles, allowing crafted bitmap subtitles to cause heap memory corruption during transcoding.

FFmpeg versions up to 9.0.2 contain an out-of-bounds write vulnerability in the v4l2_buffer_swframe_to_buf() function due to improper checking of cumulative plane offsets against the V4L2 buffer length. This flaw can cause a memory write beyond the mapped driver buffer during V4L2 M2M encoding when processing crafted video inputs with specific dimensions or padding.

CVE-2026-125207 is a vulnerability in FFmpeg versions up to 9.0.2 involving uncontrolled memory allocation in the Interplay ACM decoder. An attacker can craft a malicious ACM file that triggers decode_init() to allocate nearly a gigabyte of memory, potentially causing a denial of service by exhausting system memory.

CVE-2026-125206 is a low-severity buffer under-read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the prores_ks encoder's get_alpha_data() function when processing interlaced ProRes 4444 video frames with alpha channel and odd heights. This flaw causes out-of-bounds memory to be read and encoded into the output alpha plane.

CVE-2026-125205 is a vulnerability in FFmpeg up to version 9.0.2 involving unbounded memory allocation in the av1_frame_merge bitstream filter. An attacker can exploit this by supplying a crafted .obu file that omits temporal delimiter OBUs, causing unlimited buffering and memory exhaustion, resulting in denial of service.

A heap-based buffer overflow vulnerability exists in FFmpeg versions up to 9.0.2 in the ff_libwebp_get_frame() function. This flaw allows attackers to corrupt memory by supplying crafted media that increases resolution mid-stream, causing out-of-bounds writes and potential application crashes.

CVE-2026-125203 is a heap buffer overflow vulnerability in FFmpeg's Cook multichannel decoder affecting versions before 8.1.3 and 9.x before 9.0.2. The flaw arises from improper verification of overlapping subpacket channel masks in crafted RealMedia Cook streams, leading to out-of-bounds writes during decoding.

CVE-2026-125202 is a heap buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the vaapi_hevc_start_frame() function when processing HEVC bitstreams with large pictures and many tiles, leading to out-of-bounds writes in fixed-size arrays. This can corrupt memory in applications using VAAPI for hardware-accelerated decoding.

CVE-2026-125201 is a heap out-of-bounds write vulnerability in FFmpeg's Vulkan AV1 decoder. It affects FFmpeg versions 7.0 up to but not including 8.1.3, and 9.0 up to but not including 9.0.2. The flaw occurs because the tile-count limit is only checked on entry, allowing an attacker to supply a crafted AV1 stream with more than 256 tiles, which can overflow tile_sizes and corrupt heap memory.

CVE-2026-125200 is a memory leak vulnerability in FFmpeg versions 7.1 through 9.0.2 in the libavcodec/libx265.c component. The function libx265_encode_frame() fails to free memory allocated for rpu.payload by ff_dovi_rpu_generate(), leading to unbounded memory growth when processing crafted Dolby Vision HEVC or AV1 files. This can cause denial of service due to resource exhaustion.

CVE-2026-125199 is a medium severity memory leak vulnerability in FFmpeg versions 8.1 through 9.0.2. It occurs in the vc1_decode_frame() function of libavcodec/vc1dec.c, where slice buffers are leaked if init_get_bits8() fails. Crafted files with repeated oversized VC-1 slices can trigger this leak, potentially exhausting the memory of applications that decode such files.

CVE-2026-125198 is a memory leak vulnerability in FFmpeg versions up to 9.0.2. It occurs in the mediaformat_jni_setBuffer() function within libavcodec/mediacodec_wrapper.c, where buffers created with NewDirectByteBuffer() are not freed. This flaw allows attackers to cause native memory exhaustion by supplying crafted media files with large extradata to Android applications using MediaCodec decoders.

CVE-2026-125197 is an integer underflow vulnerability in FFmpeg up to version 9.0.2. It occurs in the decode_frame() function of libavcodec/lcldec.c and allows attackers to cause a heap out-of-bounds read by supplying crafted short ZLIB packets with the FLAG_MULTITHREAD flag. This can be triggered by a malicious AVI or MKV file containing an LCL video stream with packets shorter than 8 bytes, bypassing length clamping and potentially crashing the decoding application.

CVE-2026-125196 is a heap-based buffer overflow vulnerability in FFmpeg versions 8.0 through 9.0.2. It occurs in the liboapve_encode() function within libavcodec/liboapvenc.c when processing video frames larger than the configured encoder dimensions. This flaw allows attackers to corrupt heap memory by crafting videos with resolution changes mid-stream, causing transcoding to APV without rescaling to write attacker-controlled pixel data beyond allocated buffers.

CVE-2026-125195 is a low-severity vulnerability in FFmpeg versions up to 9.0.2. It involves an uninitialized memory disclosure in the adpcm_encode_frame() function when encoding mono ADPCM_MS audio with trellis enabled. This flaw causes output packets to leak stale heap memory, potentially exposing sensitive data from the encoding process.

CVE-2026-125194 is an out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the pcm_dvd_encode_frame() function when processing 24-bit audio frames that have fewer samples than expected in the final frame. This can cause a loop counter to wrap, leading to a crash of the transcoding process.

CVE-2026-125193 is an out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the bitpacked_decode_uyvy422() function due to lack of verification that packets contain sufficient data. Crafted truncated bitpacked UYVY422 packets can cause application crashes or memory exposure.

CVE-2026-125192 is a medium severity vulnerability in FFmpeg up to version 9.0.2. It involves an uninitialized memory issue in the DXA decoder component, where crafted DXA video files with a specific frame type can cause uninitialized heap memory to be copied into output frames, potentially leaking sensitive data.

CVE-2026-125191 is a medium severity vulnerability in FFmpeg up to version 9.0.2. It involves a reference count leak in the libavcodec/v4l2_buffers.c component that can cause a deadlock in the V4L2 mem2mem decoder when processing multi-plane capture formats. Crafted H.264, HEVC, or VP9 streams with resolution changes can trigger the issue, causing the decoding application to hang indefinitely.