Heap Overflow Vulnerability in FFmpeg's QSV Encoder
CVE-2026-125235

7.3HIGH

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125235?

FFmpeg versions up to 9.0.2 are susceptible to a heap overflow vulnerability in libavcodec/qsvenc.c. This issue arises when attackers supply malicious input that increases in resolution mid-stream, utilizing Intel Quick Sync Video encoders without proper rescaling. Such crafted inputs can lead to memory corruption or application crashes, posing significant risks to system stability and integrity.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/q...
technical-description

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.