Heap Buffer Overflow in FFmpeg GIF Encoder Affecting FFmpeg Software

CVE-2026-125250

What is CVE-2026-125250?

FFmpeg, a widely used multimedia framework, has a vulnerability within its GIF encoder component, particularly in the gif_image_write_image() function found in libavcodec/gif.c. This issue arises from a heap buffer overflow caused by improper handling of the first frame's linesize, which is used to allocate the size of the shrunk_buf. Attackers can exploit this flaw by providing PAL8 video where the frame's linesize unexpectedly increases during streaming. As a result, this can lead to remap_frame_to_palette() writing beyond the allocated memory, leading to potential heap corruption during GIF transcoding, posing serious security risks.

References