CVE-2026-125204 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has a heap buffer overflow in the libwebp encoder path when cr_threshold is set. Crafted media that increases resolution mid-stream makes memcpy() write past a stale reference frame, corrupting memory and crashing the application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to transcode or re-encode untrusted media with the libwebp encoder and cr_threshold set, such as upload-processing services or media pipelines. Teams that only process their own trusted media, or that do not use the libwebp encoder, are much less exposed.
Not affected if cr-threshold-unset, no-libwebp-encoder, trusted-input-only
Who cares ffmpeg, media-pipeline, self-hosted
ffmpeg -version, and compare it against the fixed version in the patch linked from the NVD entry.ffmpeg -encoders | grep webp shows whether the libwebp encoder is built in.cr_threshold to the WebP encoder.9.0.2 to the patched release referenced in the linked upstream patch (exact fixed version not stated in the sources).FFmpeg through 9.0.2 contains a heap buffer overflow in ff_libwebp_get_frame() in libwebpenc_common.c that lets attackers corrupt memory when cr_threshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy() to write pixel data past the stale reference frame and crash applications.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.