Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-125209

FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt heap memory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FFmpeg FFmpeg

Default version status: unaffected

  • 0 to < 8.1.3affected
  • 9.0 to < 9.0.2affected
pkg:github/ffmpeg/ffmpeg

References