{"id":"CVE-2026-125180","kind":"vulnerability","aliases":["CVE-2026-125180"],"related":[],"title":"FFmpeg: crafted EXIF metadata in images exhausts memory, crashing decoders","description":"FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.","summary":"FFmpeg's libavcodec EXIF parser can be fed a small crafted EXIF block that causes quadratic memory allocation while decoding TIFF, JPEG, PNG or WebP images. An attacker gets denial of service against any application that decodes the attacker's image.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","image-upload","media-processing","package"],"not_affected_if":["not-in-affected-range","trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it to the affected range 8.1 through 9.0.2.\n- Find where FFmpeg libraries are linked (libavcodec) in your services and images, since embedded copies may be older.","fix":"- Move FFmpeg to a version outside the 8.1 through 9.0.2 range; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","triaged_at":"2026-11-09T19:31:35+00:00","updated_at":"2026-11-09T19:31:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:31:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move FFmpeg to a version outside the 8.1 through 9.0.2 range; the exact fixed version is unknown from the sources.","reach":"internet","title":"FFmpeg: crafted EXIF metadata in images exhausts memory, crashing decoders","impact":"low","summary":"FFmpeg's libavcodec EXIF parser can be fed a small crafted EXIF block that causes quadratic memory allocation while decoding TIFF, JPEG, PNG or WebP images. An attacker gets denial of service against any application that decodes the attacker's image.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","image-upload"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Decoding process runs out of memory and crashes, causing denial of service.","analyst_note":"Confirm the exact fixed version from the linked patch on github.com and the vulncheck advisory; the fix line above is not yet a specific version.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it to the affected range 8.1 through 9.0.2.\n- Find where FFmpeg libraries are linked (libavcodec) in your services and images, since embedded copies may be older.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-in-affected-range","trusted-input-only"],"who_is_affected":"Applications that use FFmpeg's libavcodec to decode image metadata from untrusted sources, such as upload pipelines, thumbnailers or media servers, are exposed when they process user-supplied TIFF, JPEG, PNG or WebP files. Systems that only process trusted images or do not run FFmpeg 8.1 through 9.0.2 can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000802,"input_tokens":4645,"output_tokens":675,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125180':13A,16A '-2026':12A,15A '8.1':67C '9.0.2':69C 'alloc':42B,84C,112C 'allow':80C 'amplifi':83C 'applic':59B,119C 'attack':52B,63B,81C,93C 'block':37B,100C 'caus':39B,113C 'contain':70C 'craft':2A,35B,98C 'crash':9A 'cve':11A,14A 'decod':10A,44B,61B,118C 'denial':54B,114C 'emb':95C 'entri':89C 'exhaust':7A,73C 'exif':3A,28B,36B,99C 'fed':32B 'ffmpeg':1A,17B,25B,66C 'get':53B 'ifd':88C 'imag':6A,19B,50B,65B,107C 'image-upload':18B 'jpeg':46B,103C 'libavcodec':27B 'libavcodec/exif.c':77C 'mani':87C 'media':22B 'media-process':21B 'memori':8A,41B,72C,111C 'metadata':4A 'overlap':91C 'packag':24B 'parser':29B,78C 'payload':92C 'png':47B,104C 'point':86C 'process':23B 'quadrat':40B,110C 'servic':56B,116C 'small':34B,97C 'tiff':45B,102C 'trigger':109C 'upload':20B 'vulner':74C 'webp':49B,106C","nicknames":[],"mitigations":[],"who_affected":"Applications that use FFmpeg's libavcodec to decode image metadata from untrusted sources, such as upload pipelines, thumbnailers or media servers, are exposed when they process user-supplied TIFF, JPEG, PNG or WebP files. Systems that only process trusted images or do not run FFmpeg 8.1 through 9.0.2 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","imageupload","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125180':13A,16A '-2026':12A,15A 'craft':2A 'crash':9A 'cve':11A,14A 'decod':10A 'exhaust':7A 'exif':3A 'ffmpeg':1A 'imag':6A 'memori':8A 'metadata':4A","search_b":"'alloc':42B 'applic':59B 'attack':52B,63B 'block':37B 'caus':39B 'craft':35B 'decod':44B,61B 'denial':54B 'exif':28B,36B 'fed':32B 'ffmpeg':17B,25B 'get':53B 'imag':19B,50B,65B 'image-upload':18B 'jpeg':46B 'libavcodec':27B 'media':22B 'media-process':21B 'memori':41B 'packag':24B 'parser':29B 'png':47B 'process':23B 'quadrat':40B 'servic':56B 'small':34B 'tiff':45B 'upload':20B 'webp':49B","search_c":"'8.1':67C '9.0.2':69C 'alloc':84C,112C 'allow':80C 'amplifi':83C 'applic':119C 'attack':81C,93C 'block':100C 'caus':113C 'contain':70C 'craft':98C 'decod':118C 'denial':114C 'emb':95C 'entri':89C 'exhaust':73C 'exif':99C 'ffmpeg':66C 'ifd':88C 'imag':107C 'jpeg':103C 'libavcodec/exif.c':77C 'mani':87C 'memori':72C,111C 'overlap':91C 'parser':78C 'payload':92C 'png':104C 'point':86C 'quadrat':110C 'servic':116C 'small':97C 'tiff':102C 'trigger':109C 'vulner':74C 'webp':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125180","severity":null,"published_at":"2026-11-09T19:16:53+00:00","modified_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","fetched_at":"2026-11-09T19:28:16+00:00","note":null}],"documents":[{"id":109248,"url":"https://github.com/FFmpeg/FFmpeg/commit/30fff47764e59f02ac7868bb832ed51a88f949fd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109249,"url":"https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-exif-parser-memory-exhaustion-via-overlapping-tags","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}