CVE-2026-125261: falha de média gravidade em FFmpeg
FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
FFmpeg · FFmpegCVEs relacionadas — FFmpeg
No mesmo produto, das mais perigosas para as menos.
CVE-2026-8461HIGHHeap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoderEPSS 1.6%CVE-2026-64831HIGHFFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC DecoderEPSS 0.9%CVE-2026-66040HIGHFFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf EncoderEPSS 0.8%CVE-2026-64834HIGHFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF DemuxerEPSS 0.7%CVE-2026-75143CRITICALFFmpeg Heap Buffer Overflow via RIST Protocol ReaderEPSS 0.7%CVE-2026-64830HIGHFFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle DemuxerEPSS 0.6%
Referências
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690https://github.com/FFmpeg/FFmpeghttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sgienc.c#L208https://github.com/FFmpeg/FFmpeg/commit/c6e5b6105aa13f6b0df2a646da608078cfe52d79https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-sgi-encoder-out-of-bounds-read-via-sgienc-c