{"id":"CVE-2026-125100","kind":"vulnerability","aliases":["CVE-2026-125100"],"related":[],"title":"FFmpeg: OpenEXR decoder integer overflow leaks uninitialized memory from crafted images","description":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data.","summary":"FFmpeg's OpenEXR decoder miscalculates the tiled block count in decode_frame() in libavcodec/exr.c when handed a crafted tiled image with large dimensions and small tiles. An attacker who supplies such a file can skip decoding and read uninitialized memory or stale frame data.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-exr-decoding","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the product data (unknown if the sources do not give it)\n- Check whether your build includes the OpenEXR decoder (`ffmpeg -decoders | grep exr`)","fix":null,"status":"open","published_at":"2026-11-09T19:16:51+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","triaged_at":"2026-11-09T19:33:36+00:00","updated_at":"2026-11-09T19:33:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:33:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: OpenEXR decoder integer overflow leaks uninitialized memory from crafted images","impact":"low","summary":"FFmpeg's OpenEXR decoder miscalculates the tiled block count in decode_frame() in libavcodec/exr.c when handed a crafted tiled image with large dimensions and small tiles. An attacker who supplies such a file can skip decoding and read uninitialized memory or stale frame data.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads uninitialized memory or stale frame data","analyst_note":"Find the fixed FFmpeg version and confirm the patch at github.com linked in the sources; the sources do not state a fixed version.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the product data (unknown if the sources do not give it)\n- Check whether your build includes the OpenEXR decoder (`ffmpeg -decoders | grep exr`)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-exr-decoding","trusted-input-only"],"who_is_affected":"Teams that run FFmpeg to decode OpenEXR images from untrusted sources, such as upload pipelines, thumbnailers or media services, are exposed. Systems that only process trusted media or do not decode EXR files can skip it. The sources do not name the fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000764,"input_tokens":4622,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125100':14A,17A '-2026':13A,16A '9.0.2':70C 'attack':51B,91C 'block':31B,89C 'contain':71C 'count':32B,90C 'craft':10A,41B,95C 'cve':12A,15A 'data':67B,115C 'decod':3A,27B,34B,59B,79C,81C,107C 'dimens':46B,101C 'disclos':109C 'ffmpeg':1A,18B,24B,68C 'file':56B 'frame':35B,66B,82C,114C 'hand':39B 'imag':11A,43B,98C 'integ':4A,73C 'larg':45B,100C 'leak':6A 'libavcodec':19B 'libavcodec/exr.c':37B,84C 'media':21B 'media-process':20B 'memori':8A,63B,111C 'miscalcul':28B,86C 'openexr':2A,26B,78C,97C 'overflow':5A,74C 'packag':23B 'process':22B 'read':61B 'skip':58B,106C 'small':48B,103C 'stale':65B,113C 'suppli':53B,93C 'tile':30B,42B,49B,88C,96C,104C 'uniniti':7A,62B,110C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Teams that run FFmpeg to decode OpenEXR images from untrusted sources, such as upload pipelines, thumbnailers or media services, are exposed. Systems that only process trusted media or do not decode EXR files can skip it. The sources do not name the fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125100':14A,17A '-2026':13A,16A 'craft':10A 'cve':12A,15A 'decod':3A 'ffmpeg':1A 'imag':11A 'integ':4A 'leak':6A 'memori':8A 'openexr':2A 'overflow':5A 'uniniti':7A","search_b":"'attack':51B 'block':31B 'count':32B 'craft':41B 'data':67B 'decod':27B,34B,59B 'dimens':46B 'ffmpeg':18B,24B 'file':56B 'frame':35B,66B 'hand':39B 'imag':43B 'larg':45B 'libavcodec':19B 'libavcodec/exr.c':37B 'media':21B 'media-process':20B 'memori':63B 'miscalcul':28B 'openexr':26B 'packag':23B 'process':22B 'read':61B 'skip':58B 'small':48B 'stale':65B 'suppli':53B 'tile':30B,42B,49B 'uniniti':62B","search_c":"'9.0.2':70C 'attack':91C 'block':89C 'contain':71C 'count':90C 'craft':95C 'data':115C 'decod':79C,81C,107C 'dimens':101C 'disclos':109C 'ffmpeg':68C 'frame':82C,114C 'imag':98C 'integ':73C 'larg':100C 'libavcodec/exr.c':84C 'memori':111C 'miscalcul':86C 'openexr':78C,97C 'overflow':74C 'skip':106C 'small':103C 'stale':113C 'suppli':93C 'tile':88C,96C,104C 'uniniti':110C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125100","severity":null,"published_at":"2026-11-09T19:16:51+00:00","modified_at":"2026-11-09T19:16:51+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","fetched_at":"2026-11-09T19:28:16+00:00","note":null}],"documents":[{"id":109217,"url":"https://github.com/FFmpeg/FFmpeg/commit/c05d46ea2919da83233bf4216d3f58428bb54c59","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109218,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-integer-overflow-in-openexr-decoder-tile-count","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}