FFMPEG · CVE-2026-125211 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 frees subtitle rectangles using the wrong count in the ARIB caption decoder, so crafted caption data makes it free out-of-bounds pointers. An attacker who gets FFmpeg to process a crafted media file can corrupt the heap, which can crash the process or possibly run code.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only FFmpeg builds compiled with the libaribcaption decoder (--enable-libaribcaption) are exposed, and only when they decode untrusted ARIB caption data such as broadcast recordings or transport streams. Builds without that library, and services that only process trusted files, can skip it. Affected versions are 9.0.2 and earlier; no fixed release is named yet.
Not affected if no-libaribcaption-build, trusted-input-only
Who cares ffmpeg, libaribcaption, media-processing
ffmpeg -version; 9.0.2 or earlier is in range.ffmpeg -buildconf and look for --enable-libaribcaption; if absent you are not exposed through this path.FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.0.2 and earlier); until a release ships, build from master with the commit or apply it to your tree, or use a build without libaribcaption