---
id: "CVE-2026-125211"
page: "https://infrastack.ai/live/CVE-2026-125211"
kind: "vulnerability"
aliases: ["CVE-2026-125211"]
title: "FFmpeg: crafted ARIB caption file corrupts heap memory during subtitle decoding"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "ffmpeg", "fixed": [], "affected": "<= 9.0.2 (built with libaribcaption)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ffmpeg", "libaribcaption", "media-processing", "runtime"]
not_affected_if: ["no-libaribcaption-build", "trusted-input-only"]
published_at: "2026-11-09T19:16:57+00:00"
first_seen_at: "2026-11-09T19:28:18+00:00"
updated_at: "2026-11-09T19:33:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125211", "first_seen_at": "2026-11-09T19:28:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T19:33:48+00:00"}]
exploit_sources: []
---

# FFmpeg: crafted ARIB caption file corrupts heap memory during subtitle decoding

Link for people: https://infrastack.ai/live/CVE-2026-125211 (this .md is for agents)

FFmpeg through 9.0.2 frees subtitle rectangles using the wrong count in the ARIB caption decoder, so crafted caption data makes it free out-of-bounds pointers. An attacker who gets FFmpeg to process a crafted media file can corrupt the heap, which can crash the process or possibly run code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ffmpeg affected <= 9.0.2 (built with libaribcaption) fixed no fixed version listed

## How to check

- Run `ffmpeg -version`; 9.0.2 or earlier is in range.
- Run `ffmpeg -buildconf` and look for `--enable-libaribcaption`; if absent you are not exposed through this path.
- Also check distro or bundled FFmpeg builds in your media pipelines that ingest untrusted broadcast/transport streams.
- Fix: the commit 4ec127c is on master; check whether your build includes it.

## Fix

Fixed in FFmpeg master by commit 4ec127c82678b06658e963291f272881dc878735 (changes the cleanup loop bound from region_count to sub->num_rects). No release containing it is named in the sources yet (affected: 9.0.2 and earlier); until a release ships, build from master with the commit or apply it to your tree, or use a build without libaribcaption.

## Timeline

- 2026-11-09T19:28:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125211
- 2026-11-09T19:33:48+00:00 analyst — Read fix commit (1-line loop bound change, 'free only the added rects on ass errors', PR 24992) and VulnCheck advisory. No fixed release named anywhere, so no fix version and nothing verified. Commit message describes error path after partial allocation failure; NVD/VulnCheck describe 8KiB AVBPrint overflow trigger - minor mismatch. web-cli out of Exa credits, so no social search done. Default-off status of libaribcaption not confirmed from a primary page.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-corruption-via-libaribcaption-ass-error-cleanup
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/4ec127c82678b06658e963291f272881dc878735

## From the sources

FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_