{"id":"CVE-2026-125206","kind":"vulnerability","aliases":["CVE-2026-125206"],"related":[],"title":"FFmpeg: ProRes 4444 encoder reads out-of-bounds memory into output video","description":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlaced ProRes 4444, causing out-of-bounds memory to be encoded into the output alpha plane.","summary":"FFmpeg through 9.0.2 has an out-of-bounds read in the prores_ks encoder's get_alpha_data() function, which reads memory before the blocks buffer for interlaced frames with odd heights. An attacker who supplies a crafted video with alpha and odd height can get out-of-bounds memory copied into the output alpha plane.","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","other","prores","video-encoding"],"not_affected_if":["no-prores-4444-alpha","no-untrusted-input"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the flaw is stated to affect versions through `9.0.2`.\n- Look for encoding of ProRes 4444 with alpha from untrusted input in your pipelines.","fix":"- A patch is linked from the advisory references; the sources do not state a fixed version.","status":"open","published_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:33:45+00:00","updated_at":"2026-11-09T19:33:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T19:33:45Z","model":"claude-haiku-5-5","output":{"fix":"- A patch is linked from the advisory references; the sources do not state a fixed version.","reach":"local","title":"FFmpeg: ProRes 4444 encoder reads out-of-bounds memory into output video","impact":"low","summary":"FFmpeg through 9.0.2 has an out-of-bounds read in the prores_ks encoder's get_alpha_data() function, which reads memory before the blocks buffer for interlaced frames with odd heights. An attacker who supplies a crafted video with alpha and odd height can get out-of-bounds memory copied into the output alpha plane.","audience":"developers","category":"other","nicknames":[],"who_cares":["ffmpeg","video-encoding","prores"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Out-of-bounds memory leaks into the encoded output video file.","analyst_note":"","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the flaw is stated to affect versions through `9.0.2`.\n- Look for encoding of ProRes 4444 with alpha from untrusted input in your pipelines.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-input","no-prores-4444-alpha"],"who_is_affected":"Systems that run FFmpeg's prores_ks encoder to produce ProRes 4444 video with alpha from input a person or outside party controls. Pipelines that only encode trusted, locally made video with no alpha channel are unlikely to be exposed. The sources do not say which builds or distributions ship the affected code.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00119,"input_tokens":4630,"output_tokens":1453,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125206':16A,19A '-2026':15A,18A '4444':3A,129C '9.0.2':28B,86C 'alpha':43B,67B,82B,102C,121C,142C 'attack':60B,116C 'block':51B,108C 'bound':9A,34B,76B,92C,134C 'buffer':52B,109C 'caus':130C 'contain':87C 'copi':78B 'craft':64B 'cve':14A,17A 'data':44B,103C 'encod':4A,25B,40B,99C,125C,138C 'ffmpeg':1A,20B,26B,84C 'frame':55B,112C 'function':45B 'get':42B,72B,101C 'height':58B,70B,115C,124C 'interlac':54B,111C,127C 'ks':39B,98C 'memori':10A,48B,77B,135C 'odd':57B,69B,114C,123C 'out-of-bound':6A,31B,73B,89C,131C 'output':12A,81B,141C 'plane':83B,143C 'prore':2A,22B,38B,97C,128C 'read':5A,35B,47B,93C,105C 'suppli':62B,118C 'video':13A,24B,65B,119C 'video-encod':23B 'vulner':94C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg's prores_ks encoder to produce ProRes 4444 video with alpha from input a person or outside party controls. Pipelines that only encode trusted, locally made video with no alpha channel are unlikely to be exposed. The sources do not say which builds or distributions ship the affected code.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","low","other","prores","videoencoding"],"campaign_type":null,"search_a":"'-125206':16A,19A '-2026':15A,18A '4444':3A 'bound':9A 'cve':14A,17A 'encod':4A 'ffmpeg':1A 'memori':10A 'out-of-bound':6A 'output':12A 'prore':2A 'read':5A 'video':13A","search_b":"'9.0.2':28B 'alpha':43B,67B,82B 'attack':60B 'block':51B 'bound':34B,76B 'buffer':52B 'copi':78B 'craft':64B 'data':44B 'encod':25B,40B 'ffmpeg':20B,26B 'frame':55B 'function':45B 'get':42B,72B 'height':58B,70B 'interlac':54B 'ks':39B 'memori':48B,77B 'odd':57B,69B 'out-of-bound':31B,73B 'output':81B 'plane':83B 'prore':22B,38B 'read':35B,47B 'suppli':62B 'video':24B,65B 'video-encod':23B","search_c":"'4444':129C '9.0.2':86C 'alpha':102C,121C,142C 'attack':116C 'block':108C 'bound':92C,134C 'buffer':109C 'caus':130C 'contain':87C 'data':103C 'encod':99C,125C,138C 'ffmpeg':84C 'frame':112C 'get':101C 'height':115C,124C 'interlac':111C,127C 'ks':98C 'memori':135C 'odd':114C,123C 'out-of-bound':89C,131C 'output':141C 'plane':143C 'prore':97C,128C 'read':93C,105C 'suppli':118C 'video':119C 'vulner':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125206","severity":null,"published_at":"2026-11-09T19:16:57+00:00","modified_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null}],"documents":[{"id":109302,"url":"https://github.com/FFmpeg/FFmpeg/commit/9edd06f8612c242b83bf9e3d14aa85180015a211","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109303,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-prores-ks-interlaced-alpha-encoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}