---
id: "CVE-2026-125180"
page: "https://infrastack.ai/live/CVE-2026-125180"
kind: "vulnerability"
aliases: ["CVE-2026-125180"]
title: "FFmpeg: crafted EXIF metadata in images exhausts memory, crashing decoders"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ffmpeg", "image-upload", "media-processing", "package"]
not_affected_if: ["not-in-affected-range", "trusted-input-only"]
published_at: "2026-11-09T19:16:53+00:00"
first_seen_at: "2026-11-09T19:28:16+00:00"
updated_at: "2026-11-09T19:31:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125180", "first_seen_at": "2026-11-09T19:28:16+00:00"}]
exploit_sources: []
---

# FFmpeg: crafted EXIF metadata in images exhausts memory, crashing decoders

Link for people: https://infrastack.ai/live/CVE-2026-125180 (this .md is for agents)

FFmpeg's libavcodec EXIF parser can be fed a small crafted EXIF block that causes quadratic memory allocation while decoding TIFF, JPEG, PNG or WebP images. An attacker gets denial of service against any application that decodes the attacker's image.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FFmpeg version with `ffmpeg -version` and compare it to the affected range 8.1 through 9.0.2.
- Find where FFmpeg libraries are linked (libavcodec) in your services and images, since embedded copies may be older.

## Fix

- Move FFmpeg to a version outside the 8.1 through 9.0.2 range; the exact fixed version is unknown from the sources.

## Timeline

- 2026-11-09T19:28:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125180

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-exif-parser-memory-exhaustion-via-overlapping-tags
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/30fff47764e59f02ac7868bb832ed51a88f949fd

## From the sources

FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_