CVE-2026-125180 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's libavcodec EXIF parser can be fed a small crafted EXIF block that causes quadratic memory allocation while decoding TIFF, JPEG, PNG or WebP images. An attacker gets denial of service against any application that decodes the attacker's image.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use FFmpeg's libavcodec to decode image metadata from untrusted sources, such as upload pipelines, thumbnailers or media servers, are exposed when they process user-supplied TIFF, JPEG, PNG or WebP files. Systems that only process trusted images or do not run FFmpeg 8.1 through 9.0.2 can skip it.
Not affected if not-in-affected-range, trusted-input-only
Who cares ffmpeg, image-upload, media-processing
ffmpeg -version and compare it to the affected range 8.1 through 9.0.2.FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.