FFMPEG · CVE-2026-125212 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's VideoToolbox encoder copies frames larger than its output buffers when a stream's resolution grows mid-stream, causing a heap buffer overflow. An attacker who supplies a crafted media file can crash the application or corrupt memory.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that transcode untrusted media with FFmpeg's VideoToolbox encoders on macOS, where input resolution can change mid-stream without rescaling. Pipelines that only process trusted files or do not use VideoToolbox encoders are less exposed. The sources do not name the affected versions beyond 'through 9.0.2'.
Not affected if no-videotoolbox-encoder, trusted-input-only
Who cares ffmpeg, macos, media-processing, videotoolbox
ffmpeg -version. Releases up to and including 9.0.2 are listed as affected; the fixed release is not named yet.h264_videotoolbox or hevc_videotoolbox on macOS (ffmpeg -encoders | grep videotoolbox).-noautoscale, or libavcodec API use without a scaler).FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/videotoolboxenc.c that copies frames larger than encoder dimensions into undersized CVPixelBuffers. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with VideoToolbox encoders without rescaling, to crash the application or corrupt memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.