FFMPEG · CVE-2026-125213 · Runtime
NO FIX YET · SEE WHAT TO DO
A crafted PSD image with huge dimensions and channel counts makes FFmpeg's PSD decoder truncate an allocation size and write past a heap buffer. An attacker can crash FFmpeg or possibly run code when it processes the file.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
32-bit builds of FFmpeg up to 9.0.2 (libavcodec PSD decoder) that decode untrusted PSD images, such as upload-processing, thumbnailing or transcoding pipelines. A crafted file with huge dimensions and channel counts truncates an allocation size and causes an out-of-bounds heap write, a crash or possibly code execution. 64-bit builds were not reported as affected, and systems that never decode PSD input can skip it.
Not affected if 64-bit, 64-bit-build, no-psd-input
Who cares 32-bit, ffmpeg, libavcodec, media-processing
9.0.2 are listed as affectedFFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the av_malloc allocation size so decode_rle() writes attacker-controlled data past the buffer, causing crashes or possible code execution.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.