Heap Buffer Overflow in FFmpeg's EXR Encoder Affects Multiple Versions
CVE-2026-125260

7.3HIGH

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125260?

The FFmpeg library, specifically in versions up to 9.0.2, is susceptible to a heap buffer overflow in the EXR encoder, particularly within the encode_scanline_rle() function found in libavcodec/exrenc.c. This vulnerability allows attackers to disrupt heap memory by supplying crafted input that increases resolution mid-stream during transcoding to OpenEXR with RLE compression. As a result, this could potentially lead to application crashes or further memory exploitation due to pointer writes occurring beyond the intended scanline array.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/e...
technical-description

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.