CVE-2026-125188 · Package
NO FIX YET
FFmpeg's prores_aw encoder reads memory before a heap buffer when it processes interlaced frames with odd heights. The encoded output can contain leaked heap contents.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to encode ProRes video from untrusted input, such as media processing pipelines that accept user uploads. Exposure depends on the prores_aw encoder being used on interlaced, odd-height frames. Teams that only decode or never encode ProRes can likely skip it.
Not affected if no-prores-encoding, trusted-input-only
Who cares ffmpeg, media-processing, prores
ffmpeg -version to see the installed FFmpeg version, which the sources say is affected through 9.0.2ffmpeg -encoders | grep prores_aw)No fix yet, per the sources.
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_template() to fill padding rows from memory before the fill_y buffer, leaking heap contents into the encoded output.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.