Out-of-Bounds Read Vulnerability in FFmpeg SGI Encoder

CVE-2026-125261

What is CVE-2026-125261?

FFmpeg versions up to 9.0.2 contain a vulnerability in the SGI encoder's encode_frame() function, which can lead to out-of-bounds reads. The issue arises from improper handling of negative linesize frames due to unsigned size variables. Malicious actors can exploit this vulnerability by supplying specially crafted videos that trigger the autorotate vflip feature. As a result, transcoding to SGI images can inadvertently read pixel data that lies outside the intended frame boundaries, potentially crashing the application.

References