CVE-2026-125261

Description

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690 ↗
• https://github.com/FFmpeg/FFmpeg/commit/c6e5b6105aa13f6b0df2a646da608078cfe52d79 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sgienc.c#L208 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-sgi-encoder-out-of-bounds-read-via-sgienc-c ↗