CVE-2026-125250highCWE-122

CVE-2026-125250: falha de alta gravidade em FFmpeg

FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap

Publicada em

Seguir esta CVE+ Monitorar FFmpeg

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

18Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5
FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
FFmpeg · FFmpeg
CVEs relacionadas — FFmpeg

No mesmo produto, das mais perigosas para as menos.

CVE-2026-8461HIGHHeap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoderEPSS 1.6%CVE-2026-64831HIGHFFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC DecoderEPSS 0.9%CVE-2026-66040HIGHFFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf EncoderEPSS 0.8%CVE-2026-64834HIGHFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF DemuxerEPSS 0.7%CVE-2026-75143CRITICALFFmpeg Heap Buffer Overflow via RIST Protocol ReaderEPSS 0.7%CVE-2026-64830HIGHFFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle DemuxerEPSS 0.6%