CVE-2026-125253
FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check o
CVSS
5.3
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 9 nov 2026 · Última mod.: 9 nov 2026 · CWE-190
Sin historial EPSS suficiente todavía.
FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.
- code.ffmpeg.orghttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232
- github.comhttps://github.com/FFmpeg/FFmpeg
- github.comhttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cbs_vp9.c#L400
- github.comhttps://github.com/FFmpeg/FFmpeg/commit/6280907da48c4dd78f95ef5c713a29c7702153a3
- www.vulncheck.comhttps://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vp9-cbs-superframe-integer-overflow-out-of-bounds-read
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1252677.8 ALT—
——0FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.4hCVE-2026-1252597.8 ALT—
——0FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder, causing encode_frame() to write slices past an undersized packet buffer and corrupt heap memory.4hCVE-2026-1252517.0 ALT—
——0FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.5hCVE-2026-1252497.0 ALT—
——0FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.5hCVE-2026-1252487.0 ALT—
——0FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.5hCVE-2026-1252473.3 BAJ—
——0FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.5h