FFMPEG · CVE-2026-125210 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has a heap buffer overflow in its libaribcaption subtitle decoder when a stream has zero regions. An attacker who supplies a crafted ARIB STD-B24 caption stream can corrupt heap memory, which can lead to code execution in the process that decodes the file.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg built with libaribcaption and decode caption streams from untrusted sources, such as media converters, transcoding services or upload pipelines. Builds without libaribcaption, or pipelines that never decode untrusted ARIB subtitle streams, are unlikely to be exposed.
Not affected if no-libaribcaption, trusted-input-only
Who cares ffmpeg, libaribcaption, media-processing
ffmpeg -version and compare against the fixed release named in the linked patchffmpeg -decoders | grep -i aribcaption)FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and corrupting heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.