{"id":"CVE-2026-125210","kind":"vulnerability","aliases":["CVE-2026-125210"],"related":[],"title":"FFmpeg: crafted ARIB caption stream overflows heap during subtitle decoding","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and corrupting heap memory.","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in its libaribcaption subtitle decoder when a stream has zero regions. An attacker who supplies a crafted ARIB STD-B24 caption stream can corrupt heap memory, which can lead to code execution in the process that decodes the file.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FFmpeg","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ffmpeg","libaribcaption","media-processing","package"],"not_affected_if":["no-libaribcaption","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the linked patch\n- Check whether FFmpeg was built with libaribcaption (`ffmpeg -decoders | grep -i aribcaption`)\n- Check whether your pipeline decodes untrusted broadcast or TS files with subtitle decoding enabled","fix":"- FFmpeg: unknown (the sources link a patch but do not state the fixed version)","status":"open","published_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:30:06+00:00","updated_at":"2026-11-09T19:30:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:30:06Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg: unknown (the sources link a patch but do not state the fixed version)","reach":"unknown","title":"FFmpeg: crafted ARIB caption stream overflows heap during subtitle decoding","impact":"high","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in its libaribcaption subtitle decoder when a stream has zero regions. An attacker who supplies a crafted ARIB STD-B24 caption stream can corrupt heap memory, which can lead to code execution in the process that decodes the file.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libaribcaption","media-processing"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker corrupts heap memory, possibly running code in the decoding process","analyst_note":"Confirm the fixed FFmpeg version from the linked patch on github.com and the vulncheck advisory, and whether the libaribcaption decoder is enabled in default builds.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the linked patch\n- Check whether FFmpeg was built with libaribcaption (`ffmpeg -decoders | grep -i aribcaption`)\n- Check whether your pipeline decodes untrusted broadcast or TS files with subtitle decoding enabled","plain_action":"","product_name":"FFmpeg","needs_analyst":true,"not_affected_if":["no-libaribcaption","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg built with libaribcaption and decode caption streams from untrusted sources, such as media converters, transcoding services or upload pipelines. Builds without libaribcaption, or pipelines that never decode untrusted ARIB subtitle streams, are unlikely to be exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000811,"input_tokens":4634,"output_tokens":696,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125210':13A,16A '-2026':12A,15A '9.0.2':26B,74C 'alloc':119C 'arib':3A,49B,99C 'aribcapt':82C 'attack':44B,94C 'b24':52B,102C 'buffer':30B,78C 'caption':4A,53B,103C 'caus':108C 'code':63B 'contain':75C 'corrupt':56B,121C 'craft':2A,48B,98C 'cve':11A,14A 'decod':10A,36B,69B,89C 'execut':64B 'ffmpeg':1A,17A,18B,24B,72C 'file':71B 'heap':7A,29B,57B,77C,122C 'lead':61B 'libaribcapt':19B,34B 'libavcodec/libaribcaption.c':87C 'media':21B 'media-process':20B 'memori':58B,123C 'overflow':6A,31B,79C 'packag':23B 'past':112C 'pointer':110C 'process':22B,67B 'rect':118C 'region':42B,107C 'size':116C 'std':51B,101C 'std-b24':50B,100C 'stream':5A,39B,54B,104C 'sub':91C,117C 'subtitl':9A,35B,85C 'suppli':46B,96C 'text':84C,93C 'tran':83C 'type':92C 'vulner':80C 'write':111C 'zero':41B,106C,115C 'zero-s':114C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg built with libaribcaption and decode caption streams from untrusted sources, such as media converters, transcoding services or upload pipelines. Builds without libaribcaption, or pipelines that never decode untrusted ARIB subtitle streams, are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","libaribcaption","mediaprocessing","package","vendor"],"campaign_type":null,"search_a":"'-125210':13A,16A '-2026':12A,15A 'arib':3A 'caption':4A 'craft':2A 'cve':11A,14A 'decod':10A 'ffmpeg':1A,17A 'heap':7A 'overflow':6A 'stream':5A 'subtitl':9A","search_b":"'9.0.2':26B 'arib':49B 'attack':44B 'b24':52B 'buffer':30B 'caption':53B 'code':63B 'corrupt':56B 'craft':48B 'decod':36B,69B 'execut':64B 'ffmpeg':18B,24B 'file':71B 'heap':29B,57B 'lead':61B 'libaribcapt':19B,34B 'media':21B 'media-process':20B 'memori':58B 'overflow':31B 'packag':23B 'process':22B,67B 'region':42B 'std':51B 'std-b24':50B 'stream':39B,54B 'subtitl':35B 'suppli':46B 'zero':41B","search_c":"'9.0.2':74C 'alloc':119C 'arib':99C 'aribcapt':82C 'attack':94C 'b24':102C 'buffer':78C 'caption':103C 'caus':108C 'contain':75C 'corrupt':121C 'craft':98C 'decod':89C 'ffmpeg':72C 'heap':77C,122C 'libavcodec/libaribcaption.c':87C 'memori':123C 'overflow':79C 'past':112C 'pointer':110C 'rect':118C 'region':107C 'size':116C 'std':101C 'std-b24':100C 'stream':104C 'sub':91C,117C 'subtitl':85C 'suppli':96C 'text':84C,93C 'tran':83C 'type':92C 'vulner':80C 'write':111C 'zero':106C,115C 'zero-s':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125210","severity":null,"published_at":"2026-11-09T19:16:57+00:00","modified_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null}],"documents":[{"id":109310,"url":"https://github.com/FFmpeg/FFmpeg/commit/7c06aea6f0d26dd70c94ccba6127059cd0a0e352","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109311,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-in-libaribcaption-text-subtitle-decoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}