Integer Overflow Vulnerability in FFmpeg Product by VideoLAN
CVE-2026-125248

7.3HIGH

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125248?

FFmpeg versions 9.0 to 9.0.2 are prone to an integer overflow vulnerability found in libavcodec's Vulkan encoder. This flaw arises from an undersized float remap GPU buffer when processing large GBRPF32 or GBRAPF32 images or videos, leading to potential out-of-bounds memory writes. Successful exploitation can result in system crashes or memory corruption during the transcoding process to FFV1 using the Vulkan encoder, representing a significant risk to applications utilizing this functionality.

Affected Version(s)

FFmpeg 9.0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136
issue-tracking
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/f...
technical-description
https://github.com/FFmpeg/FFmpeg
product

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.