{"id":"CVE-2026-125211","kind":"vulnerability","aliases":["CVE-2026-125211"],"related":[],"title":"FFmpeg: crafted ARIB caption file corrupts heap memory during subtitle decoding","description":"FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap.","summary":"FFmpeg through 9.0.2 frees subtitle rectangles using the wrong count in the ARIB caption decoder, so crafted caption data makes it free out-of-bounds pointers. An attacker who gets FFmpeg to process a crafted media file can corrupt the heap, which can crash the process or possibly run code.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2 (built with libaribcaption)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","libaribcaption","media-processing","runtime"],"not_affected_if":["no-libaribcaption-build","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version`; 9.0.2 or earlier is in range.\n- Run `ffmpeg -buildconf` and look for `--enable-libaribcaption`; if absent you are not exposed through this path.\n- Also check distro or bundled FFmpeg builds in your media pipelines that ingest untrusted broadcast/transport streams.\n- Fix: the commit 4ec127c is on master; check whether your build includes it.","fix":"Fixed in FFmpeg master by commit 4ec127c82678b06658e963291f272881dc878735 (changes the cleanup loop bound from region_count to sub->num_rects). No release containing it is named in the sources yet (affected: 9.0.2 and earlier); until a release ships, build from master with the commit or apply it to your tree, or use a build without libaribcaption.","status":"open","published_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:30:05+00:00","updated_at":"2026-11-09T19:33:48+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T19:30:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted ARIB caption file corrupts heap memory during subtitle decoding","impact":"high","summary":"FFmpeg through 9.0.2 frees subtitle rectangles using the wrong count in the ARIB caption decoder, so crafted caption data makes it free out-of-bounds pointers. An attacker who gets FFmpeg to process a crafted media file can corrupt the heap, which can crash the process or possibly run code.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","libaribcaption"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"heap corruption in the FFmpeg process; possible code execution","analyst_note":"Confirm the fixed FFmpeg version and the patch commit from the linked fix source, and check whether the decoder is enabled by default in release builds.","how_to_check":"- Check the installed version with `ffmpeg -version`, and compare it against the fixed release in the product data.\n- Check whether FFmpeg was built with libaribcaption support (`ffmpeg -buildconf` shows `--enable-libaribcaption`).\n- Look for services that decode untrusted broadcast or transport streams with FFmpeg.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-libaribcaption-build","trusted-input-only"],"who_is_affected":"Only builds of FFmpeg compiled with the libaribcaption decoder are exposed through this code path, and the risk applies when FFmpeg processes untrusted ARIB caption data such as broadcast recordings or transport streams. Services that transcode only trusted local files are lower risk. The sources name a patch but do not state the fixed version in the product ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000798,"input_tokens":4646,"output_tokens":666,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and the patch commit from the linked fix source, and check whether the decoder is enabled by default in release builds.","search":"'-125211':14A,17A '-2026':13A,16A '8':119C '9.0.2':27B,78C 'arib':3A,37B,112C 'aribcapt':91C 'ass':93C 'attack':53B,108C 'avbprint':121C 'bound':50B,84C,130C 'caption':4A,38B,42B,113C 'cleanup':124C 'code':75B 'contain':79C 'corrupt':6A,64B,133C 'count':34B,103C 'craft':2A,41B,60B,111C 'crash':69B 'cve':12A,15A 'data':43B 'decod':11A,39B 'exceed':117C 'ffmpeg':1A,18A,19B,25B,56B,76C 'file':5A,62B 'free':28B,46B,88C,98C,126C 'get':55B 'heap':7A,66B,135C 'instead':104C 'invalid':87C 'kib':120C 'later':115C 'libaribcapt':20B 'libavcodec/libaribcaption.c':96C 'limit':122C 'make':44B 'media':22B,61B 'media-process':21B 'memori':8A 'num':106C 'out-of-bound':47B,81C,127C 'pointer':51B,131C 'possibl':73B 'process':23B,58B,71B 'read':85C 'rect':107C 'rectangl':30B,100C 'region':102C,116C 'run':74B 'runtim':24B 'subtitl':10A,29B,94C,99C 'suppli':110C 'tran':92C 'trigger':123C 'use':31B,101C 'vulner':89C 'whose':114C 'wrong':33B","nicknames":[],"mitigations":[],"who_affected":"Only FFmpeg builds compiled with the libaribcaption decoder (--enable-libaribcaption) are exposed, and only when they decode untrusted ARIB caption data such as broadcast recordings or transport streams. Builds without that library, and services that only process trusted files, can skip it. Affected versions are 9.0.2 and earlier; no fixed release is named yet.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","libaribcaption","mediaprocessing","runtime"],"campaign_type":null,"search_a":"'-125211':14A,17A '-2026':13A,16A 'arib':3A 'caption':4A 'corrupt':6A 'craft':2A 'cve':12A,15A 'decod':11A 'ffmpeg':1A,18A 'file':5A 'heap':7A 'memori':8A 'subtitl':10A","search_b":"'9.0.2':27B 'arib':37B 'attack':53B 'bound':50B 'caption':38B,42B 'code':75B 'corrupt':64B 'count':34B 'craft':41B,60B 'crash':69B 'data':43B 'decod':39B 'ffmpeg':19B,25B,56B 'file':62B 'free':28B,46B 'get':55B 'heap':66B 'libaribcapt':20B 'make':44B 'media':22B,61B 'media-process':21B 'out-of-bound':47B 'pointer':51B 'possibl':73B 'process':23B,58B,71B 'rectangl':30B 'run':74B 'runtim':24B 'subtitl':29B 'use':31B 'wrong':33B","search_c":"'8':119C '9.0.2':78C 'arib':112C 'aribcapt':91C 'ass':93C 'attack':108C 'avbprint':121C 'bound':84C,130C 'caption':113C 'cleanup':124C 'contain':79C 'corrupt':133C 'count':103C 'craft':111C 'exceed':117C 'ffmpeg':76C 'free':88C,98C,126C 'heap':135C 'instead':104C 'invalid':87C 'kib':120C 'later':115C 'libavcodec/libaribcaption.c':96C 'limit':122C 'num':106C 'out-of-bound':81C,127C 'pointer':131C 'read':85C 'rect':107C 'rectangl':100C 'region':102C,116C 'subtitl':94C,99C 'suppli':110C 'tran':92C 'trigger':123C 'use':101C 'vulner':89C 'whose':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125211","severity":null,"published_at":"2026-11-09T19:16:57+00:00","modified_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125211:2330","url":null,"severity":null,"published_at":"2026-11-09T19:33:48+00:00","modified_at":"2026-11-09T19:33:48+00:00","first_seen_at":"2026-11-09T19:33:48+00:00","fetched_at":"2026-11-09T19:33:48+00:00","note":"Read fix commit (1-line loop bound change, 'free only the added rects on ass errors', PR 24992) and VulnCheck advisory. No fixed release named anywhere, so no fix version and nothing verified. Commit message describes error path after partial allocation failure; NVD/VulnCheck describe 8KiB AVBPrint overflow trigger - minor mismatch. web-cli out of Exa credits, so no social search done. Default-off status of libaribcaption not confirmed from a primary page."}],"documents":[{"id":109312,"url":"https://github.com/FFmpeg/FFmpeg/commit/4ec127c82678b06658e963291f272881dc878735","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109313,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-corruption-via-libaribcaption-ass-error-cleanup","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}