CVE-2026-125209
Discovered by AISLEPUBLISHEDCWE-131
Description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt heap memory.
CVSS Base Scores
CVSS v4.08.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS v3.1
7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| FFmpeg | FFmpeg | 0 | affected |
| FFmpeg | FFmpeg | 9.0 | affected |
Credits
- Zheng Yu @ Depthfirst(finder)
- Joshua Rogers (AISLE Research)(reporter)
- Michael Niedermayer(remediation developer)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24486
- https://github.com/FFmpeg/FFmpeg/commit/8702f12c9daa199cc4d7c17164b13c3cdcdc2436
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/dvdsubenc.c#L344
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-heap-buffer-overflow-via-dvdsubenc-c