Out-of-Bounds Read Vulnerability in FFmpeg's Vorbis Encoder

CVE-2026-125228

What is CVE-2026-125228?

FFmpeg versions prior to 8.1.3 and 9.x before 9.0.2 are susceptible to an out-of-bounds read vulnerability in the put_vector() function located in libavcodec/vorbisenc.c. This vulnerability arises when attackers supply audio data containing NaN (Not a Number) float samples, which can result in the Vorbis encoder referencing invalid codebook entries, specifically leading to values such as -1. Consequently, this may trigger heap reads before arrays, potentially causing application crashes or leaking sensitive adjacent memory content.

References