FFmpeg vulnerabilities and threats

CVE-2026-125270 is a heap out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the v4l2_buffer_swframe_to_buf() function when handling frames with a negative linesize. Maliciously crafted bottom-up AVI or PNM/PFM files can trigger this flaw during transcoding to a V4L2 M2M encoder, potentially causing application crashes or leaking heap memory into the encoded output.

A double free vulnerability exists in FFmpeg versions up to 9.0.2 in the libavcodec/cbs_sei.c component. The function cbs_sei_delete_message() leaves a stale reference that is later reused by ff_cbs_sei_add_message(), leading to heap memory corruption when processing crafted H.264 streams with specific SEI messages.

CVE-2026-125268 is a medium severity vulnerability in FFmpeg up to version 9.0.2 involving uninitialized memory disclosure in the CineForm HD decoder. An attacker can craft a CFHD file with a manipulated ImageHeight tag to cause uninitialized heap memory to leak into the decoded video output.

CVE-2026-125267 is a heap out-of-bounds write vulnerability in FFmpeg's APAC decoder caused by an integer overflow due to an unreset bitstream index. This flaw affects FFmpeg versions before 8.1.3 and 9.x before 9.0.2. An attacker can craft a malicious APAC file that triggers the overflow, leading to heap corruption or application crashes.

CVE-2026-125266 is a medium severity vulnerability in FFmpeg versions 8.0 through 9.0.2. It involves an uninitialized stack memory disclosure in the old_codec23() function of libavcodec/sanm.c. This flaw allows attackers to leak stack bytes into decoded video frames by supplying a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table.

CVE-2026-125265 is a use-after-free vulnerability in FFmpeg versions up to 9.0.2. It occurs in the libavcodec/nvdec.c component where ff_nvdec_start_frame() does not properly reset a context pointer after slice errors. This flaw allows crafted video input to cause cuvidDecodePicture() to access freed heap memory, potentially crashing applications or exposing stale memory contents.

CVE-2026-125264 is a resource exhaustion vulnerability in FFmpeg versions up to 9.0.2. It occurs in the parse_frame_header() function of libavcodec/jpegxl_parser.c, where the TOC entry counts are not properly validated against the remaining input. An attacker can craft a JPEG XL frame header with a manipulated TOC and an excessively large toc_count, causing the parser to loop excessively and consume excessive CPU resources.

CVE-2026-125263 is a medium severity vulnerability in FFmpeg versions 9.0 through 9.0.2 when built with liblcevc_dec. The flaw involves improper validation of LCEVC enhanced output dimensions against max_pixels before frame allocation, allowing attackers to supply crafted video streams that cause excessive memory allocation and potential exhaustion.

CVE-2026-125262 is a heap buffer overflow vulnerability in FFmpeg versions 7.1 through 9.0.2. It occurs in the LCEVC decoder component when output picture dimensions are not properly validated against the allocated frame size. Crafted LCEVC enhancement data embedded in H.264 or HEVC streams can trigger heap corruption during decoding.

CVE-2026-125261 is an out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the SGI encoder's encode_frame() function due to improper handling of negative linesize frames, allowing crafted video input to cause the process to read memory outside the intended frame and crash.

FFmpeg versions up to 9.0.2 contain a heap-based buffer overflow vulnerability in the libavcodec/exrenc.c component. This flaw occurs when the encode_scanline_rle() function processes frames taller than the encoder height, allowing crafted input with a resolution that grows mid-stream to corrupt heap memory. The vulnerability can cause application crashes by writing pointers beyond the scanline array during OpenEXR encoding with RLE compression.

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the ProRes encoder initialization function. This flaw causes incorrect calculation of a frame size upper bound using 32-bit arithmetic for large video frames. An attacker can exploit this by supplying a high-resolution video encoded with the prores_ks encoder, leading to heap memory corruption due to buffer overflow during encoding.

FFmpeg versions up to 9.0.2 contain a division by zero vulnerability in the dovi_configure_ext() function within libavcodec/dovi_rpuenc.c. This flaw allows attackers to cause a denial of service by crashing the process when supplying a crafted HEVC or AV1 input with a nonzero frame rate numerator and a zero denominator to certain encoders or bitstream filters.

An off-by-one heap overflow vulnerability exists in FFmpeg versions up to 9.0.2 in the get_exponent_dynamic() function within libavcodec/nellymoserenc.c. This flaw allows an attacker to write one element past allocated memory when encoding Nellymoser audio with trellis enabled, potentially overwriting adjacent heap memory.

CVE-2026-125256 is a heap buffer overflow vulnerability in FFmpeg versions 7.0 through 9.0.2. It occurs in the ff_llvidenc_diff_bytes_rvv() function of the Huffyuv encoder on RVV-enabled RISC-V builds. The flaw allows attackers to corrupt heap memory by supplying RGB video narrower than 8 or 16 pixels, causing out-of-bounds writes past the encoder's temporary buffer.

CVE-2026-125255 is a use-after-free vulnerability in FFmpeg versions up to 9.0.2. It occurs in the MJPEG decoder component when processing crafted MJPEG streams containing a Start of Frame (SOF) marker without a preceding Start of Image (SOI) marker. This flaw can cause the decoder to use a stale pointer, potentially leading to application crashes or heap memory disclosure.

CVE-2026-125254 is a division by zero vulnerability in FFmpeg versions up to 9.0.2 affecting the VVC decoder. The flaw occurs because the function ff_vvc_slice_rpl() does not properly validate the number of active reference indices against the built reference list entries. A crafted VVC bitstream with excess reference indices can cause a zero picture order count (POC) difference in ff_vvc_mv_scale(), leading to a crash during decoding.

CVE-2026-125253 is an integer overflow vulnerability in FFmpeg versions up to 9.0.2 affecting 32-bit builds. The flaw exists in the cbs_vp9_split_fragment() function within libavcodec/cbs_vp9.c, where a crafted VP9 packet with a forged superframe index can cause an integer overflow leading to out-of-bounds reads and application crashes.

CVE-2026-125252 is a medium severity memory leak vulnerability in FFmpeg up to version 9.0.2. It occurs in the libavcodec/vaapi_decode.c component when processing crafted video streams with slice parse errors. This flaw allows attackers to exhaust memory by causing continuous leaks of VA parameter and slice buffers, as well as driver and heap memory.

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the VVC decoder's alloc_frame() function on 32-bit builds. This flaw causes undersized allocation of the reference picture list, allowing crafted VVC (H.266) files with many NAL units to trigger heap out-of-bounds writes and memory corruption.