CVE-2026-125248: high-severity vulnerability in FFmpeg
FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3
FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
FFmpeg · FFmpegRelated CVEs — FFmpeg
In the same product, most dangerous first.
CVE-2026-8461HIGHHeap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoderEPSS 1.6%CVE-2026-64831HIGHFFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC DecoderEPSS 0.9%CVE-2026-66040HIGHFFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf EncoderEPSS 0.8%CVE-2026-64834HIGHFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF DemuxerEPSS 0.7%CVE-2026-75143CRITICALFFmpeg Heap Buffer Overflow via RIST Protocol ReaderEPSS 0.7%CVE-2026-64830HIGHFFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle DemuxerEPSS 0.6%