{"id":"CVE-2026-125194","kind":"vulnerability","aliases":["CVE-2026-125194"],"related":[],"title":"FFmpeg: short 24-bit DVD audio frame causes out-of-bounds read and crash","description":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process.","summary":"FFmpeg's DVD PCM encoder reads past the end of a buffer when the final 24-bit audio frame is shorter than one block. An attacker who supplies crafted 24-bit 48 or 96 kHz audio can crash the transcoding process.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","transcoding"],"not_affected_if":["ffmpeg-not-used","no-untrusted-audio"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`.","fix":"- Patch referenced by the sources (github.com); the fixed version is not stated in the sources.","status":"open","published_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:31:30+00:00","updated_at":"2026-11-09T19:31:30+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:30Z","model":"claude-haiku-5-5","output":{"fix":"- Patch referenced by the sources (github.com); the fixed version is not stated in the sources.","reach":"unknown","title":"FFmpeg: short 24-bit DVD audio frame causes out-of-bounds read and crash","impact":"low","summary":"FFmpeg's DVD PCM encoder reads past the end of a buffer when the final 24-bit audio frame is shorter than one block. An attacker who supplies crafted 24-bit 48 or 96 kHz audio can crash the transcoding process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","transcoding","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Transcoding process crashes; denial of service on the affected host","analyst_note":"Confirm the fixed FFmpeg version and the patch commit from the github.com link; the sources do not state a fixed version.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-audio","ffmpeg-not-used"],"who_is_affected":"Systems that run FFmpeg to transcode user-supplied 24-bit DVD audio are exposed. Pipelines that only process trusted media, or that do not run FFmpeg, can skip it. The sources do not name the affected version range beyond 'through 9.0.2'.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4638,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125194':18A,21A '-2026':17A,20A '24':3A,43B,57B,89C,102C '48':59B,104C '9.0.2':71C '96':61B,106C 'attack':53B,99C 'audio':6A,45B,63B,108C 'bit':4A,44B,58B,90C,103C 'block':51B,98C 'bound':12A,77C 'buffer':39B 'caus':8A,116C 'contain':72C 'counter':119C 'craft':56B 'crash':15A,65B,123C 'cve':16A,19A 'dvd':5A,30B,82C 'encod':32B,83C 'end':36B 'fewer':94C 'ffmpeg':1A,22B,28B,69C 'final':42B,91C,114C 'frame':7A,46B,84C,92C,115C 'hold':93C 'khz':62B,107C 'leav':111C 'length':110C 'libavcodec/pcm-dvdenc.c':86C 'loop':118C 'media':24B 'media-process':23B 'one':50B,97C 'out-of-bound':9A,74C 'past':34B 'pcm':31B,81C 'process':25B,68B,126C 'read':13A,33B,78C 'runtim':26B 'sampl':95C 'short':2A,113C 'shorter':48B 'suppli':55B,101C 'transcod':27B,67B,125C 'vulner':79C 'whose':109C 'wrap':121C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to transcode user-supplied 24-bit DVD audio are exposed. Pipelines that only process trusted media, or that do not run FFmpeg, can skip it. The sources do not name the affected version range beyond 'through 9.0.2'.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","runtime","transcoding"],"campaign_type":null,"search_a":"'-125194':18A,21A '-2026':17A,20A '24':3A 'audio':6A 'bit':4A 'bound':12A 'caus':8A 'crash':15A 'cve':16A,19A 'dvd':5A 'ffmpeg':1A 'frame':7A 'out-of-bound':9A 'read':13A 'short':2A","search_b":"'24':43B,57B '48':59B '96':61B 'attack':53B 'audio':45B,63B 'bit':44B,58B 'block':51B 'buffer':39B 'craft':56B 'crash':65B 'dvd':30B 'encod':32B 'end':36B 'ffmpeg':22B,28B 'final':42B 'frame':46B 'khz':62B 'media':24B 'media-process':23B 'one':50B 'past':34B 'pcm':31B 'process':25B,68B 'read':33B 'runtim':26B 'shorter':48B 'suppli':55B 'transcod':27B,67B","search_c":"'24':89C,102C '48':104C '9.0.2':71C '96':106C 'attack':99C 'audio':108C 'bit':90C,103C 'block':98C 'bound':77C 'caus':116C 'contain':72C 'counter':119C 'crash':123C 'dvd':82C 'encod':83C 'fewer':94C 'ffmpeg':69C 'final':91C,114C 'frame':84C,92C,115C 'hold':93C 'khz':107C 'leav':111C 'length':110C 'libavcodec/pcm-dvdenc.c':86C 'loop':118C 'one':97C 'out-of-bound':74C 'pcm':81C 'process':126C 'read':78C 'sampl':95C 'short':113C 'suppli':101C 'transcod':125C 'vulner':79C 'whose':109C 'wrap':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125194","severity":null,"published_at":"2026-11-09T19:16:55+00:00","modified_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109279,"url":"https://github.com/FFmpeg/FFmpeg/commit/cfe6a6cd7de59341a70ebe6a2d477f3281aec834","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109280,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-pcm-dvd-encoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}