{"id":"CVE-2026-125212","kind":"vulnerability","aliases":["CVE-2026-125212"],"related":[],"title":"FFmpeg: crafted mid-stream resolution change overflows heap via VideoToolbox encoder","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/videotoolboxenc.c that copies frames larger than encoder dimensions into undersized CVPixelBuffers. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with VideoToolbox encoders without rescaling, to crash the application or corrupt memory.","summary":"FFmpeg's VideoToolbox encoder copies frames larger than its output buffers when a stream's resolution grows mid-stream, causing a heap buffer overflow. An attacker who supplies a crafted media file can crash the application or corrupt memory.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","macos","media-processing","package","videotoolbox"],"not_affected_if":["no-videotoolbox-encoder","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version`. Releases up to and including 9.0.2 are listed as affected; the fixed release is not named yet.\n- Check whether you encode with `h264_videotoolbox` or `hevc_videotoolbox` on macOS (`ffmpeg -encoders | grep videotoolbox`).\n- Check whether your pipeline can pass input whose resolution grows mid-stream without rescaling (e.g. `-noautoscale`, or libavcodec API use without a scaler).\n- Also check if you use other FFmpeg encoders (the commit message says software encoders were found during triage) and check your build has commit 9b99973.","fix":"Upstream commit 9b99973 (avcodec/encode: reject video frames larger than the encoder too) fixes it in libavcodec/encode.c. No release containing it is named in the sources: fixed version unknown. Until then build from master with the commit, or avoid -noautoscale and make sure frames are scaled to the encoder size before a VideoToolbox encoder.","status":"open","published_at":"2026-11-09T19:16:58+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:30:04+00:00","updated_at":"2026-11-09T19:33:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:30:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted mid-stream resolution change overflows heap via VideoToolbox encoder","impact":"medium","summary":"FFmpeg's VideoToolbox encoder copies frames larger than its output buffers when a stream's resolution grows mid-stream, causing a heap buffer overflow. An attacker who supplies a crafted media file can crash the application or corrupt memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","macos","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes or heap memory is corrupted by crafted media input","analyst_note":"Confirm the fixed FFmpeg version from the linked patch on github.com and the vulncheck advisory; the sources give no version or check.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed version in the product ranges (unknown in the sources).\n- Check whether builds use the VideoToolbox encoders (`h264_videotoolbox`, `hevc_videotoolbox`) on macOS.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-videotoolbox-encoder","trusted-input-only"],"who_is_affected":"Systems that transcode untrusted media with FFmpeg's VideoToolbox encoders on macOS, where input resolution can change mid-stream without rescaling. Pipelines that only process trusted files or do not use VideoToolbox encoders are less exposed. The sources do not name the affected versions beyond 'through 9.0.2'.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4634,"output_tokens":611,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version from the linked patch on github.com and the vulncheck advisory; the sources give no version or check.","search":"'-125212':15A,18A '-2026':14A,17A '9.0.2':69C 'applic':63B,108C 'attack':53B,88C 'buffer':37B,50B,73C 'caus':47B 'chang':7A 'contain':70C 'copi':31B,79C 'corrupt':65B,110C 'craft':2A,57B,91C 'crash':61B,106C 'cve':13A,16A 'cvpixelbuff':87C 'dimens':84C 'encod':12A,30B,83C,102C 'ffmpeg':1A,19A,20B,27B,67C 'file':59B 'frame':32B,80C 'grow':43B,95C 'heap':9A,49B,72C 'input':92C 'larger':33B,81C 'libavcodec/videotoolboxenc.c':77C 'maco':21B 'media':23B,58B 'media-process':22B 'memori':66B,111C 'mid':4A,45B,97C 'mid-stream':3A,44B,96C 'output':36B 'overflow':8A,51B,74C 'packag':25B 'process':24B 'rescal':104C 'resolut':6A,42B,94C 'stream':5A,40B,46B,98C 'suppli':55B,90C 'transcod':99C 'unders':86C 'via':10A 'videotoolbox':11A,26B,29B,101C 'vulner':75C 'whose':93C 'without':103C","nicknames":[],"mitigations":[],"who_affected":"Systems that transcode untrusted media with FFmpeg's VideoToolbox encoders on macOS, where input resolution can change mid-stream without rescaling. Pipelines that only process trusted files or do not use VideoToolbox encoders are less exposed. The sources do not name the affected versions beyond 'through 9.0.2'.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","macos","mediaprocessing","package","videotoolbox"],"campaign_type":null,"search_a":"'-125212':15A,18A '-2026':14A,17A 'chang':7A 'craft':2A 'cve':13A,16A 'encod':12A 'ffmpeg':1A,19A 'heap':9A 'mid':4A 'mid-stream':3A 'overflow':8A 'resolut':6A 'stream':5A 'via':10A 'videotoolbox':11A","search_b":"'applic':63B 'attack':53B 'buffer':37B,50B 'caus':47B 'copi':31B 'corrupt':65B 'craft':57B 'crash':61B 'encod':30B 'ffmpeg':20B,27B 'file':59B 'frame':32B 'grow':43B 'heap':49B 'larger':33B 'maco':21B 'media':23B,58B 'media-process':22B 'memori':66B 'mid':45B 'mid-stream':44B 'output':36B 'overflow':51B 'packag':25B 'process':24B 'resolut':42B 'stream':40B,46B 'suppli':55B 'videotoolbox':26B,29B","search_c":"'9.0.2':69C 'applic':108C 'attack':88C 'buffer':73C 'contain':70C 'copi':79C 'corrupt':110C 'craft':91C 'crash':106C 'cvpixelbuff':87C 'dimens':84C 'encod':83C,102C 'ffmpeg':67C 'frame':80C 'grow':95C 'heap':72C 'input':92C 'larger':81C 'libavcodec/videotoolboxenc.c':77C 'memori':111C 'mid':97C 'mid-stream':96C 'overflow':74C 'rescal':104C 'resolut':94C 'stream':98C 'suppli':90C 'transcod':99C 'unders':86C 'videotoolbox':101C 'vulner':75C 'whose':93C 'without':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125212","severity":null,"published_at":"2026-11-09T19:16:58+00:00","modified_at":"2026-11-09T19:16:58+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125212:2329","url":null,"severity":null,"published_at":"2026-11-09T19:33:56+00:00","modified_at":"2026-11-09T19:33:56+00:00","first_seen_at":"2026-11-09T19:33:56+00:00","fetched_at":"2026-11-09T19:33:56+00:00","note":"Read vulncheck advisory (affected <= 9.0.2, no fixed release named) and the upstream commit 9b99973 (libavcodec/encode.c: encoder now rejects any frame whose size differs from the encoder's). Commit page names no release tag, so fixed version is unknown. Web-cli was out of credits; used WebFetch."}],"documents":[{"id":109298,"url":"https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b7e1e57035b95498b42f54a6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109315,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-videotoolbox-encoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}