CVE-2026-125188

FFmpeg through 9.0.2 ProRes prores_aw Heap Out-of-Bounds Read in Interlaced Encoding

FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_template() to fill padding rows from memory before the fill_y buffer, leaking heap contents into the encoded output.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125104

FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125103

FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized heap bytes into decoded audio output.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125098

FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125212

FFmpeg through 9.0.2 Heap Buffer Overflow via VideoToolbox Encoder

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/videotoolboxenc.c that copies frames larger than encoder dimensions into undersized CVPixelBuffers. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with VideoToolbox encoders without rescaling, to crash the application or corrupt memory.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125196

FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125171

FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125267

FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125243

FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125239

FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_dxva2_hevc_fill_picture_parameters() that allows attackers to corrupt memory via unbounded non-uniform tile counts. Attackers can supply crafted HEVC bitstreams with many non-uniformly spaced tiles to write controlled 16-bit values past fixed-size DXVA arrays during DXVA2, D3D11VA, or D3D12VA decoding on Windows.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125235

FFmpeg through 9.0.2 Heap Overflow via QSV Encoder submit_frame()

FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with Intel Quick Sync encoders without rescaling, to crash the application or corrupt heap memory.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125227

FFmpeg through 9.0.2 Heap Buffer Overflow via cbs_jpeg_write_scan Integer Overflow

FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filter_units, to corrupt the heap or crash the application.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125219

FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vdpau_hevc_start_frame() in libavcodec/vdpau_hevc.c that copies unbounded PPS tile counts into fixed-size VDPAU arrays. Attackers can supply crafted HEVC bitstreams with excessive tile columns or rows to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications using VDPAU decoding.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125175

FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder

FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125102

FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125244

FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's sh_entry_points() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing entry_point_start_ctu and corrupting decoder memory.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125236

FFmpeg through 9.0.2 VVC Decoder Memory Leak via alloc_frame()

FFmpeg through 9.0.2 contains a memory leak vulnerability in alloc_frame() in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC (H.266) stream that repeatedly replaces parameter sets, steadily growing memory use and causing denial of service.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125208

FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2_bufref_to_buf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125228

FFmpeg before 8.1.3 and 9.x before 9.0.2 Out-of-Bounds Read in Vorbis Encoder

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, causing heap reads before arrays that crash the application or leak adjacent heap memory into output.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125172

FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg