Integer Overflow Vulnerability in FFmpeg's ProRes Encoder

CVE-2026-125259

What is CVE-2026-125259?

FFmpeg versions up to 9.0.2 are susceptible to an integer overflow vulnerability in the ff_prores_kostya_encode_init() function. This flaw arises from the incorrect calculation of frame_size_upper_bound using 32-bit arithmetic when dealing with large video frame dimensions. Attackers may exploit this vulnerability by supplying high-resolution video files that have been transcoded with the prores_ks encoder. This results in encode_frame() attempting to write data beyond a constrained packet buffer, potentially leading to heap memory corruption and subsequent impact on system stability.

References