CVE-2026-125100

LowCVSS 3.3/10Last modified Nov 10, 2026

Description

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-190

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
FFmpeg	FFmpeg	<= 9.0.2

References

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1251013.3FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cu CVE-2026-1251023.3FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to ve CVE-2026-1251033.3FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string co CVE-2026-1251045.5FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728 CVE-2026-1251053.7Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditio CVE-2026-1251066.5Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the s CVE-2026-1251077.5Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::Crea CVE-2026-1251083.7Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading e CVE-2026-1251094.8Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return a CVE-2026-125118.1The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing CVE-2026-1251105.3Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info norm CVE-2026-1251117.5Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its inter