CVE-2026-125206

Description

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlaced ProRes 4444, causing out-of-bounds memory to be encoded into the output alpha plane.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24490 ↗
• https://github.com/FFmpeg/FFmpeg/commit/9edd06f8612c242b83bf9e3d14aa85180015a211 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/proresenc_kostya.c#L150 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-prores-ks-interlaced-alpha-encoding ↗