CVE-2026-125206 · Other
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has an out-of-bounds read in the prores_ks encoder's get_alpha_data() function, which reads memory before the blocks buffer for interlaced frames with odd heights. An attacker who supplies a crafted video with alpha and odd height can get out-of-bounds memory copied into the output alpha plane.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg's prores_ks encoder to produce ProRes 4444 video with alpha from input a person or outside party controls. Pipelines that only encode trusted, locally made video with no alpha channel are unlikely to be exposed. The sources do not say which builds or distributions ship the affected code.
Not affected if no-prores-4444-alpha, no-untrusted-input
Who cares ffmpeg, prores, video-encoding
ffmpeg -version; the flaw is stated to affect versions through 9.0.2.FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlaced ProRes 4444, causing out-of-bounds memory to be encoded into the output alpha plane.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.