CVE-2026-125248

HighCVSS 7.0/10Last modified Nov 10, 2026

Description

FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
FFmpeg	FFmpeg	>= 9.0, <= 9.0.2

References

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1252497.0FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulka CVE-2026-125258.8The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, CVE-2026-1252507.8FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is CVE-2026-1252517.0FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that unde CVE-2026-1252524.7FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying CVE-2026-1252535.3FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check o CVE-2026-1252545.5FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_a CVE-2026-1252555.3FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by CVE-2026-1252567.0FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap mem CVE-2026-1252577.0FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows CVE-2026-1252584.7FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to CVE-2026-1252597.8FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound