Integer Overflow Vulnerability in FFmpeg's VVC Decoder

CVE-2026-125251

What is CVE-2026-125251?

The FFmpeg library prior to version 9.0.2 is exposed to an integer overflow vulnerability within the VVC decoder. This flaw resides in the alloc_frame() function located in libavcodec/vvc/refs.c, which inadequately sizes the reference picture list allocation on 32-bit architecture builds. Attackers can leverage this weakness by crafting malicious VVC (H.266) files containing an excessive number of NAL units per access unit. When exploited, this can result in heap out-of-bounds writes, potentially leading to memory corruption and application instability.

References