CVE-2026-125209 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg's DVD subtitle encoder underestimates the output size for odd-width bitmap subtitle rectangles, causing a heap buffer overflow. An attacker who supplies a crafted bitmap subtitle file can corrupt heap memory when it is transcoded to dvdsub.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to transcode media from untrusted sources, particularly bitmap subtitles converted to DVD subtitle format, are exposed. Servers that only process trusted media or never use the dvdsub encoder can deprioritize this, though upgrading is still the straightforward fix.
Not affected if dvdsub-encoder-unused, no-untrusted-media
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -version; affected builds are before 8.1.3 on the 8.x line and before 9.0.2 on the 9.x line.-c:s dvdsub.8.1.3 or later.9.0.2 or later.FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.