Heap Overflow Vulnerability in FFmpeg Product by FFmpeg
CVE-2026-125257

7.3HIGH

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125257?

FFmpeg versions up to 9.0.2 contain a heap overflow vulnerability within the get_exponent_dynamic() function in libavcodec/nellymoserenc.c. This flaw allows attackers to exploit crafted audio data sent to applications that use the Nellymoser encoder with trellis enabled. By manipulating the input, an attacker can cause the index variable to equal OPT_SIZE, resulting in the potential to overwrite adjacent heap memory, which could lead to instability or arbitrary code execution.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24471
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/733bec3e19759520c...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/n...
technical-description

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zheng Yu
Joshua Rogers (AISLE Research)
Michael Niedermayer
.