{"id":"CVE-2026-125209","kind":"vulnerability","aliases":["CVE-2026-125209"],"related":[],"title":"FFmpeg: crafted subtitle files overflow heap memory during DVD transcoding","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt heap memory.","summary":"FFmpeg's DVD subtitle encoder underestimates the output size for odd-width bitmap subtitle rectangles, causing a heap buffer overflow. An attacker who supplies a crafted bitmap subtitle file can corrupt heap memory when it is transcoded to dvdsub.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","self-hosted"],"not_affected_if":["dvdsub-encoder-unused","no-untrusted-media"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; affected builds are before `8.1.3` on the 8.x line and before `9.0.2` on the 9.x line.\n- Look for pipelines that transcode bitmap subtitles into the dvdsub format, for example `-c:s dvdsub`.","fix":"- FFmpeg 8.x: move to `8.1.3` or later.\n- FFmpeg 9.x: move to `9.0.2` or later.","status":"open","published_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:29:33+00:00","updated_at":"2026-11-09T19:29:33+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T19:29:33Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg 8.x: move to `8.1.3` or later.\n- FFmpeg 9.x: move to `9.0.2` or later.","reach":"unknown","title":"FFmpeg: crafted subtitle files overflow heap memory during DVD transcoding","impact":"high","summary":"FFmpeg's DVD subtitle encoder underestimates the output size for odd-width bitmap subtitle rectangles, causing a heap buffer overflow. An attacker who supplies a crafted bitmap subtitle file can corrupt heap memory when it is transcoded to dvdsub.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker corrupts heap memory, possibly running code on the host","analyst_note":"","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; affected builds are before `8.1.3` on the 8.x line and before `9.0.2` on the 9.x line.\n- Look for pipelines that transcode bitmap subtitles into the dvdsub format, for example `-c:s dvdsub`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-media","dvdsub-encoder-unused"],"who_is_affected":"Systems that run FFmpeg to transcode media from untrusted sources, particularly bitmap subtitles converted to DVD subtitle format, are exposed. Servers that only process trusted media or never use the dvdsub encoder can deprioritize this, though upgrading is still the straightforward fix.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4635,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125209':13A,16A '-2026':12A,15A '8.1.3':67C '9':69C '9.0.2':72C 'attack':47B,94C 'bitmap':38B,52B,100C 'buffer':44B,76C,113C 'caus':41B 'contain':73C 'corrupt':56B,115C 'craft':2A,51B,99C 'cve':11A,14A 'dvd':9A,27B,81C 'dvdsub':64B,107C 'encod':29B,83C,108C 'ffmpeg':1A,17B,25B,65C 'file':4A,54B,97C 'heap':6A,43B,57B,75C,116C 'host':24B 'media':19B 'media-process':18B 'memori':7A,58B,117C 'odd':36B,91C 'odd-width':35B,90C 'output':32B,87C,112C 'overflow':5A,45B,77C 'past':110C 'process':20B 'rectangl':40B,93C 'rle':86C 'runtim':21B 'self':23B 'self-host':22B 'size':33B,88C 'subtitl':3A,28B,39B,53B,82C,101C 'suppli':49B,96C 'transcod':10A,62B,104C 'underestim':30B,85C 'vulner':78C 'width':37B,92C 'write':109C 'x':70C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to transcode media from untrusted sources, particularly bitmap subtitles converted to DVD subtitle format, are exposed. Servers that only process trusted media or never use the dvdsub encoder can deprioritize this, though upgrading is still the straightforward fix.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","high","mediaprocessing","runtime","selfhosted"],"campaign_type":null,"search_a":"'-125209':13A,16A '-2026':12A,15A 'craft':2A 'cve':11A,14A 'dvd':9A 'ffmpeg':1A 'file':4A 'heap':6A 'memori':7A 'overflow':5A 'subtitl':3A 'transcod':10A","search_b":"'attack':47B 'bitmap':38B,52B 'buffer':44B 'caus':41B 'corrupt':56B 'craft':51B 'dvd':27B 'dvdsub':64B 'encod':29B 'ffmpeg':17B,25B 'file':54B 'heap':43B,57B 'host':24B 'media':19B 'media-process':18B 'memori':58B 'odd':36B 'odd-width':35B 'output':32B 'overflow':45B 'process':20B 'rectangl':40B 'runtim':21B 'self':23B 'self-host':22B 'size':33B 'subtitl':28B,39B,53B 'suppli':49B 'transcod':62B 'underestim':30B 'width':37B","search_c":"'8.1.3':67C '9':69C '9.0.2':72C 'attack':94C 'bitmap':100C 'buffer':76C,113C 'contain':73C 'corrupt':115C 'craft':99C 'dvd':81C 'dvdsub':107C 'encod':83C,108C 'ffmpeg':65C 'file':97C 'heap':75C,116C 'memori':117C 'odd':91C 'odd-width':90C 'output':87C,112C 'overflow':77C 'past':110C 'rectangl':93C 'rle':86C 'size':88C 'subtitl':82C,101C 'suppli':96C 'transcod':104C 'underestim':85C 'vulner':78C 'width':92C 'write':109C 'x':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125209","severity":null,"published_at":"2026-11-09T19:16:57+00:00","modified_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null}],"documents":[{"id":109308,"url":"https://github.com/FFmpeg/FFmpeg/commit/8702f12c9daa199cc4d7c17164b13c3cdcdc2436","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109309,"url":"https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-heap-buffer-overflow-via-dvdsubenc-c","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}